Você está na página 1de 168

Case 2:13-cr-00082-KJM Document 70 Filed 09/09/15 Page 1 of 3

1 BENJAMIN B. WAGNER
United States Attorney
2 MATTHEW D. SEGAL
PAUL HEMESATH
3 Assistant United States Attorneys
501 I Street, Suite 10-100
4 Sacramento, CA 95814
Telephone: (916) 554-2700
5 Facsimile: (916) 554-2900
6 LESLIE R. CALDWELL
Assistant Attorney General
7 United States Department of Justice, Criminal Division
JAMES SILVER
8 Deputy Chief for Litigation
Computer Crime and Intellectual Property Section
9 Washington, DC 20530
Telephone: (202) 514-1026
10
Attorneys for Plaintiff
11 United States of America
12

IN THE UNITED STATES DISTRICT COURT

13

EASTERN DISTRICT OF CALIFORNIA

14
15 UNITED STATES OF AMERICA,
Plaintiff,

16
v.

17
18 MATTHEW KEYS,

Defendant.

19

CASE NO. 2:13-CR-82 KJM


UNITED STATES MOTION IN LIMINE #1
REGARDING PROOF OF LOSS
DATE: September 25, 2015
TIME: 9:00 a.m.
COURT: Hon. Kimberly J. Mueller

20
21

The United States moves for an in limine ruling on the admissibility of the evidence it will offer

22 to prove the loss element of the charge in Count 2 of the Superseding Indictment. The United States
23 intends to offer evidence that between October 28, 2010 through January 5, 2010, Keyss course of
24 conduct caused loss in the monetary value of the time that salaried employees spent investigating and
25 responding. The proof will be proffered chronologically. First, Fox 40 employees will testify about
26 their time-consuming efforts to identity and stop the perpetrator of attacks that began soon after Keys
27 was fired. At the time, they could not prove Keys was behind the conduct, but in the course of denying
28 responsibility, Keys predicted that Anonymous was going to attack The Los Angeles Times. That
U.S. MIL #1 RE PROOF OF LOSS

Case 2:13-cr-00082-KJM Document 70 Filed 09/09/15 Page 2 of 3


1 happened, of course, and Keys was behind it. In the second part of the Governments case, Tribune
2 Company information technology employees will testify about the time that they spent responding,
3 conducting a damage assessment, and restoring the system.
4

During the offense, Fox 40 and the The Los Angeles Times were both part of Tribune Company

5 and shared the same network and login credentials. The Superseding Indictment charges that
6 defendants course of conduct lasted between October 28, 2010 and January 5, 2010. (Superseding
7 Indictment at Count 1, 1(h); Count 2, 1-2). The proper inquiry for the jury is what aggregate
8 damage Keys caused in that period. Creative Computing v. Getloaded.com LLC, 386 F.3d 930, 935 (9th
9 Cir. 2004) (The damage floor in the Computer Fraud and Abuse Act contains no single act
10 requirement.).
11

Tribune Company employee time will be valued at hourly rates derived from each employees

12 salary. The Ninth Circuit has approved this proof method. See United States v. Middleton, 231 F.3d
13 1207, 1214 (9th Cir. 2000). Costs associated with investigating intrusions into a computer network and
14 taking subsequent remedial measures are losses within the meaning of the statute. Multiven, Inc. v.
15 Cisco Sys., Inc., 725 F. Supp. 2d 887, 895 (N.D. Cal. 2010).
16

This all occurred within the course of conduct and caused by it. The Superseding Indictment

17 expressly alleges that after he was fired, but before he made contact with Anonymous, Keys kept and
18 used for malicious purposes login credentials to Tribunes server. (Superseding Indictment at Count 1,
19 1(h); Count 2, 1-2). For example, Keys repeatedly deactivated his replacements login credentials.
20 (She will also testify about her own lost time and its value.) Keys sent a command to Tribune
21 Companys server to download Fox 40s list of about 20,000 viewers who had signed up for an affinity
22 program and then used that list to send spam to Fox 40s viewers. Once Keys gained access to the
23 Anonymous IRC channel, he actually offered the list to Anonymous.
24

Witnesses Brandon Mercer and Jerry Del Core will testify that as Fox 40 employees, they spent

25 scores of hours trying to identify the source of the network breach and stop it. They did this in meetings
26 among management, counsel, and law enforcement. Mercer even had consensually recorded meetings
27 with Keys in order to help the FBI figure out if Keys was the one behind the theft and misuse of Fox
28 40s contact list. These efforts were all expended during the time period charged in Count 2 and will be
U.S. MIL #1 RE PROOF OF LOSS

Case 2:13-cr-00082-KJM Document 70 Filed 09/09/15 Page 3 of 3


1 valued based on the salary of the people involved.
2

Witnesses Tim Rodriguez, Tom Comings, and Dylan Kulesza will testify that once an editor of

3 The Los Angeles Times discovered that a story had been defaced, they spent scores of hours responding.
4 They will assess a monetary value to their time based on their salary.
5

This proof method is entirely conventional and the United States therefore asks for an in limine

6 ruling as to its propriety.


7

Respectfully submitted,

8 Dated: September 9, 2015

BENJAMIN B. WAGNER
United States Attorney

9
10

By: /s/ MATTHEW D. SEGAL


MATTHEW D. SEGAL
Assistant United States Attorney

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
U.S. MIL #1 RE PROOF OF LOSS

Case 2:13-cr-00082-KJM Document 67 Filed 09/09/15 Page 1 of 4


1 BENJAMIN B. WAGNER
United States Attorney
2 MATTHEW D. SEGAL
PAUL A. HEMESATH
3 Assistant United States Attorneys
501 I Street, Suite 10-100
4 Sacramento, CA 95814
Telephone: (916) 554-2700
5 Facsimile: (916) 554-2900
6 LESLIE R. CALDWELL
Assistant Attorney General
7 United States Department of Justice, Criminal Division
JAMES SILVER
8 Deputy Chief for Litigation
Computer Crime and Intellectual Property Section
9 Washington, DC 20530
Telephone: (202) 514-1026
10
11

IN THE UNITED STATES DISTRICT COURT

12

EASTERN DISTRICT OF CALIFORNIA

13
14

UNITED STATES OF AMERICA,


Plaintiff,

15
16
17

v.
MATTHEW KEYS,
Defendant.

18
19
20

I.

CASE NO. 2:13-CR-0082 KJM


UNITED STATES MOTION IN LIMINE #2 TO
ADMIT SUMMARY OF VOLUMINOUS
EVIDENCE PURSUANT TO FEDERAL RULE OF
EVIDENCE 1006
DATE: September 25, 2015
TIME: 9:00 a.m.
COURT: Hon. Kimberly J. Mueller

INTRODUCTION
The United States requests an in-limine ruling admitting into evidence a summary of voluminous

21

22 evidence.
23
24

II.

FACTS
While assembling its case-in-chief, the government has reviewed several categories of

25 voluminous evidence, including computers, external hard drives, and server logs which, if printed to
26 paper, would consume tens of thousands of pages. Moreover, some of this evidence is in a challenging
27 format, rendering its examination unusually difficult.
28

In order to distill this evidence into a comprehensible summary, the government has created a
GOVERNMENTS MOTION IN LIMINE

Case 2:13-cr-00082-KJM Document 67 Filed 09/09/15 Page 2 of 4


1 Microsoft PowerPoint presentation, which is attached. (Exh. A.)
2
3
4
5
6
7
8

III.

LAW
A. Federal Rule of Evidence 1006 Permits the Use of A Summary to Prove the Content of
Voluminous Writings That Cannot Be Conveniently Examined in Court.
Federal Rule of Evidence 1006 (Summaries to Prove Content) provides:
The proponent may use a summary, chart, or calculation to prove the content of
voluminous writings, recordings, or photographs that cannot be conveniently examined in
court. The proponent must make the originals or duplicates available for examination or
copying, or both, by other parties at a reasonable time and place. And the court may
order the proponent to produce them in court

9
10

The Ninth Circuit has recognized that summary evidence can help the jury organize and

11 evaluate evidence which is factually complex and fragmentally revealed in the testimony of the
12
13
14
15
16

multitude of witnesses. United States v. Shirley, 884 F.2d 1130, 1133 (9th Cir. 1989) (quoting United
States v. Lemire, 720 F.2d 1327, 1348 (D.C. Cir. 1983)); see also United States v. Meyers, 847 F.2d
1408, 1412 (9th Cir. 1988) (approving the use of a summary witness where the sequence of events was
confusing and the chart contributed to the clarity of presentation). Such summaries are admissible

th
17 evidence. Meyers, 847 F.2d at 1412; United States v. Wood, 943 F.2d 1048, 1053 (9 Cir. 1991).

18

Although the underlying materials upon which the summary testimony is based must be

19 admissible and available for inspection, they need not be actually admitted into evidence. Meyers,
20
21
22
23

847 F.2d at 1412; United States v. Johnson, 594 F.2d 1253, 1257 n.6 (9th Cir. 1979). The foundation
for admission of such a summary is simply that the records are voluminous and that in-court
examination would be inconvenient. United States v. Duncan, 919 F.2d 981, 988 (5th Cir. 1990). If the

24 underlying documents are themselves admissible, they need not be in evidence for a summary witness to
25 describe them and admit the summary of voluminous records. Fed. R. Evid. 1006.
26

The summary witness may review the evidence in a manner that advocates the Governments

27 theory of the case, and need not give effect to the contentions of the defendant. United States v. Moore,
28
GOVERNMENTS MOTION IN LIMINE

Case 2:13-cr-00082-KJM Document 67 Filed 09/09/15 Page 3 of 4


1 997 F.2d 55, 58-59 (5th Cir. 1993). Copies of the summaries may be published to the jury while the
2 summary witness testifies concerning them. Id.
3
4
5

A district courts decision to admit a summary under Rule 1006 is reviewed for abuse of
discretion. United States v. Anekwu, 695 F.3d 967, 982 (9th Cir. 2012).

6
7
8

B. The Records Underlying the Summary Are Admissible, Voluminous, and Would Be
Inconvenient to Examine In Court.

The summary draws from multiple hard drives seized by the Federal Bureau of Investigation, as

10 well as server logs obtained from a victim company, third-party business records, and the anticipated
11 testimony of a trial witness who will precede the introduction of the summary.
Each of these categories of evidence is admissible. A stipulation of the parties filed in this case

12

13 (Document 66) established the authenticity and admissibility, subject only to a showing of relevance, of
14 the third-party business records and victim server logs that partially underlie the summary. Subject to
15 ongoing discussions about additional stipulations and the resolution of a pending motion to quash, the
16 government plans to admit the remaining categories of underlying records through the testimony of trial
17 witnesses with personal knowledge.
The summary draws from voluminous hard drives and server log files that would be

18

19 inconvenient to examine in court, and would total in the tens of thousands of pages if printed to paper.
20 In light of the unusual formatting of certain of these files, it has been inconvenient to review them even
21 in specialized computer forensic facilities.
Finally, the defense has been provided with the records underlying the summary, and will have

22

23 the opportunity to cross-examine the witness presenting it.


24
25
26

IV.

CONCLUSION
As the underlying records are admissible, voluminous, and would be inconvenient to examine in

court, the Court should admit into evidence the attached summary.

27
28
GOVERNMENTS MOTION IN LIMINE

Case 2:13-cr-00082-KJM Document 67 Filed 09/09/15 Page 4 of 4


1
2

Dated: September 9, 2015

LESLIE R. CALDWELL
Assistant Attorney General

3
By: /s/ JAMES SILVER
JAMES SILVER
Deputy Chief for Litigation

4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
GOVERNMENTS MOTION IN LIMINE

Case 2:13-cr-00082-KJM Document 71 Filed 09/09/15 Page 1 of 2


1 BENJAMIN B. WAGNER
United States Attorney
2 MATTHEW D. SEGAL
PAUL HEMESATH
3 Assistant United States Attorneys
501 I Street, Suite 10-100
4 Sacramento, CA 95814
Telephone: (916) 554-2700
5 Facsimile: (916) 554-2900
6 LESLIE R. CALDWELL
Assistant Attorney General
7 United States Department of Justice, Criminal Division
JAMES SILVER
8 Deputy Chief for Litigation
Computer Crime and Intellectual Property Section
9 Washington, DC 20530
Telephone: (202) 514-1026
10
Attorneys for Plaintiff
11 United States of America
12

IN THE UNITED STATES DISTRICT COURT

13

EASTERN DISTRICT OF CALIFORNIA

14
15 UNITED STATES OF AMERICA,
Plaintiff,

16
v.

17
18 MATTHEW KEYS,

Defendant.

19

CASE NO. 2:13-CR-82 KJM


UNITED STATES MOTION IN LIMINE #3
TO BAR EVIDENCE REGARDING OTHER
HACKER PROSECUTIONS
DATE: September 25, 2015
TIME: 9:00 a.m.
COURT: Hon. Kimberly J. Mueller

20
21

The United States moves for an order barring evidence and argument regarding how or whether

22 other computer hackers who were charged and how any cases were resolved, unless for the purpose of
23 impeaching a witness who was convicted. This case is one of a number that resulted from a wave of
24 hacking attacks by persons associated with Anonymous. In the United States and elsewhere, law
25 enforcement succeeded in identifying and prosecuting people. But the Governments prosecutive
26 decisions in other cases are irrelevant to whether Keys is guilty of the crimes alleged in the Superseding
27 Indictment.
28

Such evidence or argument could only suggest that there was selective prosecution of the
U.S. MIL #3 TO BAR EVIDENCE OF OTHER HACKING
PROSECUTIONS

Case 2:13-cr-00082-KJM Document 71 Filed 09/09/15 Page 2 of 2


1 Defendant Keys, a claim that would have to be made to the Court, not the jury. A selective prosecution
2 claim is not a defense on the merits to the criminal charge itself, but an independent assertion that the
3 prosecutor has brought the charge for reasons forbidden by the Constitution. United States v.
4 Armstrong, 517 U.S. 456, 463 (1996). It would be a pretrial motion for the Court. United States v.
5 Oaks, 508 F.2d 1403, 1404 (9th Cir. 1974).
6

Of course, if Defendant actually calls convicted members of Anonymous, he may impeach them

7 with their convictions. Fed. R. Evid. 609.


8
Respectfully submitted,

9
10 Dated: September 9, 2015

BENJAMIN B. WAGNER
United States Attorney

11
12

By: /s/ MATTHEW D. SEGAL


MATTHEW D. SEGAL
Assistant United States Attorney

13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
U.S. MIL #3 TO BAR EVIDENCE OF OTHER HACKING
PROSECUTIONS

Case 2:13-cr-00082-KJM Document 72 Filed 09/09/15 Page 1 of 2


1 BENJAMIN B. WAGNER
United States Attorney
2 MATTHEW D. SEGAL
PAUL HEMESATH
3 Assistant United States Attorneys
501 I Street, Suite 10-100
4 Sacramento, CA 95814
Telephone: (916) 554-2700
5 Facsimile: (916) 554-2900
6 LESLIE R. CALDWELL
Assistant Attorney General
7 United States Department of Justice, Criminal Division
JAMES SILVER
8 Deputy Chief for Litigation
Computer Crime and Intellectual Property Section
9 Washington, DC 20530
Telephone: (202) 514-1026
10
Attorneys for Plaintiff
11 United States of America
12

IN THE UNITED STATES DISTRICT COURT

13

EASTERN DISTRICT OF CALIFORNIA

14
15 UNITED STATES OF AMERICA,
Plaintiff,

16
v.

17
18 MATTHEW KEYS,
19

Defendant.

CASE NO. 2:13-CR-82 KJM


UNITED STATES MOTION IN LIMINE #4
TO ESTABLISH COMPLETENESS OF EXCERPTS
OF DEFENDANTS STATEMENT
DATE: September 25, 2015
TIME: 9:00 a.m.
COURT: Hon. Kimberly J. Mueller

20
21

The United States intends to offer excerpts of the statement that Defendant made when agents

22 executed a search warrant at his residence and moves for a finding that the attached selected excerpts are
23 sufficiently complete so as not to be misleading and require supplement.
24

Offered by the United States, these out-of-court statements are admissible as statements of a

25 party opponent. Fed. R. Evid. 801(d)(2)(A). If offered by the Defendant, these statements would be
26 inadmissible hearsay. Fed. R. Evid. 801(c), 802. See, e.g., United States v. Mitchell, 502 F.3d 931, 96427 965 (9th Cir. 2007) (These statements [by defendant] were inadmissible
28 hearsay; as [defendant] was attempting to introduce them himself, they were not party-opponent
U.S. MIL #4 TO ESTAB. COMPLETENESS OF EXCERPTS
OF DEFENDANTS STATEMENT

Case 2:13-cr-00082-KJM Document 72 Filed 09/09/15 Page 2 of 2


1 admissions, nor did the fact that they were made in a more broadly self-inculpatory confession bring
2 them within the statement-against-interest exception.); United States v. Ortega, 203 F.3d 675, 682 (9th
3 Cir. 2000) (affirming trial courts preclusion of defendant eliciting on cross-examination exculpatory
4 statements given to law enforcement officer); United States v. Fernandez, 839 F.2d 639, 640 (9th Cir.
5 1988) (It seems obvious defense counsel wished to place [defendants denial to police officer] before
6 the jury without subjecting [defendant] to cross-examination, precisely what the hearsay rule forbid.).
7

If the Government publishes the attached excerpts, the Rule of Completeness, Fed. R. Evid. 106,

8 does not provide the Defendant a route to offering his own hearsay into evidence. The Ninth Circuit
9 teaches, The Rule [of Completeness] does not . . . require the introduction of any unedited writing or
10 statement merely because an adverse party has introduced an edited version. United States v. Vallejos,
11 742 F.3d 902, 905 (9th Cir. 2014). It is not proper to allow a Defendant to bring in un-cross-examined,
12 self-exculpating hearsay in the guise of presenting the flavor of the interview. Id. Rather, if the
13 complete statement does not serve to correct a misleading impression in the edited statement that is
14 created by taking something out of context, the Rule of Completeness will not be applied to admit the
15 full statement. Id. Rule 106 does not compel admission of otherwise inadmissible hearsay
16 evidence. United States v. Collicott, 92 F.3d 973, 983 (9th Cir. 1996).
17

The Government has not yet finished marking its exhibits and choosing what excerpts to offer.

18 Attached to this motion a transcript of the complete statement of the Defendant with the currently
19 planned excerpts marked in yellow highlight. In the interest of avoiding trial surprise and delay, the
20 United States asks for a ruling that each of the highlighted excerpts does not convey a misleading
21 impression by taking things out of context, and may therefore be admitted into evidence without
22 supplement.
23

Respectfully submitted,

24 Dated: September 9, 2015

BENJAMIN B. WAGNER
United States Attorney

25
26

By: /s/ MATTHEW D. SEGAL


MATTHEW D. SEGAL
Assistant United States Attorney

27
28
U.S. MIL #4 TO ESTAB. COMPLETENESS OF EXCERPTS
OF DEFENDANTS STATEMENT

Case 2:13-cr-00082-KJM Document 68 Filed 09/09/15 Page 1 of 3


1 BENJAMIN B. WAGNER
United States Attorney
2 MATTHEW D. SEGAL
PAUL A. HEMESATH
3 Assistant United States Attorneys
501 I Street, Suite 10-100
4 Sacramento, CA 95814
Telephone: (916) 554-2700
5 Facsimile: (916) 554-2900
6 LESLIE R. CALDWELL
Assistant Attorney General
7 United States Department of Justice, Criminal Division
JAMES SILVER
8 Deputy Chief for Litigation
Computer Crime and Intellectual Property Section
9 Washington, DC 20530
Telephone: (202) 514-1026
10
11

IN THE UNITED STATES DISTRICT COURT

12

EASTERN DISTRICT OF CALIFORNIA

13
14

UNITED STATES OF AMERICA,


Plaintiff,

15
16
17

v.
MATTHEW KEYS,
Defendant.

18
19

I.

CASE NO. 2:13-CR-0082 KJM


GOVERNMENTS MOTION IN LIMINE #5 TO
EXCLUDE TESTIMONY OF UNDISCLOSED
ALIBI WITNESSES
DATE: September 25, 2015
TIME: 9:00 a.m.
COURT: Hon. Kimberly J. Mueller

INTRODUCTION
The United States requests an in-limine ruling barring Defendant Matthew Keys from presenting

20

21 the testimony of any witnesses in support of an alibi defense as to the six particular acts described in
22 Exhibit A hereto.
23
24

II.

FACTS
On March 26, 2015, the government emailed the defense a letter requesting notice of any alibi

25 defense for six specific acts. (Exh. A.) A table contained in the letter specified the time, date, and place
26 of the acts. (Id.) On April 20, 2015, having received no response from the defense, the government
27 emailed the defense to ask whether it intended to respond, or sought additional time. The defense asked
28 if it could have until the end of the week, and the government agreed to this extension. This was the last
GOVERNMENTS MOTION IN LIMINE

Case 2:13-cr-00082-KJM Document 68 Filed 09/09/15 Page 2 of 3


1 communication on the matter.
2
3
4
5
6
7
8
9
10
11
12

III.

LAW
A. Federal Rule of Criminal Procedure 12.1 Requires the Defense, Upon the Governments
Request, to Provide Written Notice of Intent to Offer an Alibi Defense.
Rule 12.1(a) (Governments Request for Notice and Defendants Response) provides:
(1)
Governments Request. An attorney for the government may
request in writing that the defendant notify an attorney for the government of any
alibi defense. The request must state the time, date, and place of the alleged
offense.
(2)
Defendants Response. Within 14 days after the request, or at
some other time the court sets, the defendant must serve written notice on an
attorney for the government of any intended alibi defense. The defendants notice
must state:
(A) each specific place where the defendant claims to have been at the
time of the alleged offense; and
(B) the name, address, and telephone number of each alibi witness on
whom the defendant intends to rely.

13
14
15
16
17

B. If A Party Fails to Comply With the Rule, the Court May Exclude the Testimony of
Any Undisclosed Alibi Witness.
Federal Rule of Criminal Procedure 12.1(e) (Failure to Comply) states that [i]f a party fails to
comply with this rule, the court may exclude the testimony of any undisclosed witness regarding the
defendants alibi. This rule does not limit the defendants right to testify.

18
19
20
21
22
23
24
25
26
27
28

C. As Defendant Has Failed to Comply with the Rule, the Court Should Exclude the
Testimony of Any Alibi Witnesses Whose Testimony Would Pertain to the
Governments March 26 Request.
The purpose of Rule 12.1 is to prevent a defendant from surprising the government with alibi
testimony. In Wardius v. Oregon, 412 U.S. 470, 473, 93 S.Ct. 2208, 2211, 37 L.Ed.2d 82 (1973),
explained that notice-of-alibi rules
are based on the proposition that the ends of justice will best be served by a system of
liberal discovery which gives both parties the maximum possible amount of information
with which to prepare their cases and thereby reduces the possibility of surprise at trial.
The Advisory Committee Notes to the rule further explain:
Rule 12.1 will serve a useful purpose even though rule 16 now requires disclosure of the
GOVERNMENTS MOTION IN LIMINE

Case 2:13-cr-00082-KJM Document 68 Filed 09/09/15 Page 3 of 3


1

names and addresses of government and defense witnesses. There are cases in which the
identity of defense witnesses may be known, but it may come as a surprise to the
government that they intend to testify as to an alibi and there may be no advance notice
of the details of the claimed alibi. The result often is an unnecessary interruption and
delay in the trial to enable the government to conduct an appropriate investigation. The
objective of rule 12.1 is to prevent this by providing a mechanism which will enable the
parties to have specific information in advance of trial to prepare to meet the issue of alibi
during the trial.

2
3
4
5

6 Fed R. Crim. P. 12.1 advisory committees note.


The Ninth Circuit has repeatedly held that a district court did not abuse its discretion by barring

8 defendants from calling undisclosed alibi witnesses. United States v. Henderson, 241 F.3d 638, 650 (9th
9 Cir. 2000) (defense alibi witness not disclosed until third day of four-day trial); United States v.
10 Benavidez, 992 F.2d 1220 (Table), 1993 WL 131217, *1-2 (9th Cir. 1993) (defense provided no alibi
11 notice); United States v. Barron, 575 F.2d 752, 755-58 (9th Cir. 1978) (defense alibi witness disclosure
12 came one day late).
The Henderson court further held that a district court does not err by not requiring any showing

13

14 of surprise or prejudice to the government. A trial court may reject testimony of an alibi witness when it
15 finds that the defendant has willfully failed to follow procedural rules applicable to the presentation of
16 such evidence. Henderson, 241 F.3d at 650 (citing Taylor v. Illinois, 484 U.S. 400, 414-15, 108 S.Ct.
17 646, 98 L.Ed.2d 798 (1988)).
18
19

IV.

CONCLUSION
As the defense has apparently made a considered decision not to present an alibi defense, and the

20 Government has relied on that decision under the applicable rule, the United States asks the Court to bar
21 the defense from presenting the testimony of witnesses in support of such a defense.
22
23
24

Dated: September 9, 2015

LESLIE R. CALDWELL
Assistant Attorney General

25
By: /s/ JAMES SILVER
JAMES SILVER
Deputy Chief for Litigation

26
27
28
GOVERNMENTS MOTION IN LIMINE

Case 2:13-cr-00082-KJM Document 73 Filed 09/09/15 Page 1 of 2


1 BENJAMIN B. WAGNER
United States Attorney
2 MATTHEW D. SEGAL
PAUL HEMESATH
3 Assistant United States Attorneys
501 I Street, Suite 10-100
4 Sacramento, CA 95814
Telephone: (916) 554-2700
5 Facsimile: (916) 554-2900
6 LESLIE R. CALDWELL
Assistant Attorney General
7 United States Department of Justice, Criminal Division
JAMES SILVER
8 Deputy Chief for Litigation
Computer Crime and Intellectual Property Section
9 Washington, DC 20530
Telephone: (202) 514-1026
10
Attorneys for Plaintiff
11 United States of America
12

IN THE UNITED STATES DISTRICT COURT

13

EASTERN DISTRICT OF CALIFORNIA

14
15 UNITED STATES OF AMERICA,
Plaintiff,

16
v.

17
18 MATTHEW KEYS,
19

Defendant.

CASE NO. 2:13-CR-82 KJM


UNITED STATES MOTION IN LIMINE #6
TO BAR ARGUMENT OF VICTIM NEGLIGENCE
DATE: September 25, 2015
TIME: 9:00 a.m.
COURT: Hon. Kimberly J. Mueller

20
21

The United States moves for an in limine order barring Defendant from presenting evidence of

22 victim negligence and barring Defendant from arguing that agents of Tribune Company, Fox 40, and/or
23 The Los Angeles Times were negligent in the way that they operated their computer network.
24

The Ninth Circuit has already rejected the argument that evidence of a victims failure to

25 maintain a secure computer network can be used to excuse computer crime or claim that loss was not
26 caused by a defendant. In Creative Computing v. Getloaded.com LLC, 386 F.3d 930 (9th Cir. 2004),
27 the defendant argued that the plaintiff/victim had failed to install a free operating system patch that
28 would have prevented the whole incident. Id. at 936. The Ninth Circuit rejected such reasoning:
U.S. MIL #6 RE VICTIM NEGLIGENCE

Case 2:13-cr-00082-KJM Document 73 Filed 09/09/15 Page 2 of 2


1
2
3
4
5
6
7
8
9

Getloadeds argument that truckstop.com could have prevented some of


the harm by installing the [software] patch is analogous to a thief arguing
that I would not have been able to steal your television if you had
installed deadbolts instead of that silly lock I could open with a credit
card. A causal chain from the thief to the victim is not broken by a
vulnerability that the victim negligently leaves open to the thief.
Id. Victim negligence is irrelevant when it does not go to an element of the crime.
The Government is likely to present evidence that when Keys was caught, Keys himself blamed
the victim for the network practices that allowed him to commit the crime. But that is a criminals
confession. Attorneys should be barred from presenting evidence of victim negligence and barred from
arguing that such facts are in any way exculpatory. They were careless and deserved it would be a
call for nullification. It is no defense to the charges.

10
11
12

Respectfully submitted,
Dated: September 9, 2015

BENJAMIN B. WAGNER
United States Attorney

13
14

By: /s/ MATTHEW D. SEGAL


MATTHEW D. SEGAL
Assistant United States Attorney

15
16
17
18
19
20
21
22
23
24
25
26
27
28
U.S. MIL #6 RE VICTIM NEGLIGENCE

Case 2:13-cr-00082-KJM Document 74 Filed 09/09/15 Page 1 of 3


1 BENJAMIN B. WAGNER
United States Attorney
2 MATTHEW D. SEGAL
PAUL HEMESATH
3 Assistant United States Attorneys
501 I Street, Suite 10-100
4 Sacramento, CA 95814
Telephone: (916) 554-2700
5 Facsimile: (916) 554-2900
6 LESLIE R. CALDWELL
Assistant Attorney General
7 United States Department of Justice, Criminal Division
JAMES SILVER
8 Deputy Chief for Litigation
Computer Crime and Intellectual Property Section
9 Washington, DC 20530
Telephone: (202) 514-1026
10
Attorneys for Plaintiff
11 United States of America
12

IN THE UNITED STATES DISTRICT COURT

13

EASTERN DISTRICT OF CALIFORNIA

14
15 UNITED STATES OF AMERICA,
Plaintiff,

16
v.

17
18 MATTHEW KEYS,
19

Defendant.

CASE NO. 2:13-CR-82 KJM


UNITED STATES MOTION IN LIMINE #7
TO BAR CERTAIN NULLIFICATION EVIDENCE
AND ARGUMENT
DATE: September 25, 2015
TIME: 9:00 a.m.
COURT: Hon. Kimberly J. Mueller

20
21

The United States moves for an order barring evidence and argument about the following: (1)

22 the penalties Defendant will face if convicted, (2) the existence of civil remedies for violation of the
23 Computer Fraud and Abuse Act, (3) Government policies outside the record, and (4) any plea agreement
24 that might have been offered to the Defendant.
25

The United States moves for an in limine order barring Defendant from disclosing to the jury the

26 penalties that the Defendant will face if convicted. [I]t is inappropriate for a jury to consider or be
27 informed of the consequences of their verdict. United States v. Frank, 956 F.2d 872, 879 (9th Cir.
28 1991), as amended on denial of rehg (Feb. 11, 1992). [T]he jury ha[s] no sentencing function and
U.S. MIL #7 TO BAR CERTAIN NULLIFICATION
EV. & ARG.

Case 2:13-cr-00082-KJM Document 74 Filed 09/09/15 Page 2 of 3


1 should reach its verdict without regard to what sentence might be imposed. Rogers v. United States,
2 422 U.S. 35, 40 (1975). This principle reflects a basic division of labor in our legal system between
3 judge and jury. Shannon v. United States, 512 U.S. 573, 579 (1994). Moreover, providing jurors
4 sentencing information invites them to ponder matters that are not within their province, distracts them
5 from their fact-finding responsibilities, and creates a strong possibility of confusion. Id. It would be
6 especially misleading to inform a federal jury of applicable statutory maxima, because a defendant
7 seldom receives the maximum penalty permissible under the statute of conviction. United States v.
8 Larson, 495 F.3d 1094, 1106 (9th Cir. 2007) (en banc).
9

It is also irrelevant that the Computer Fraud and Abuse Act contains civil remedies not at issue in

10 this criminal trial. [T]he availability of a civil remedy is irrelevant to the issue of criminal liability[.]
11 See United States v. Buras, 633 F.2d 1356, 1360 (9th Cir. 1980); United States v. Sinagra, 584 F. Appx
12 628, 630 (9th Cir. 2014) (CFAA). Putting the possibility of civil suit in front of the jury would confuse
13 them with an irrelevant issue. See Buras, 633 F.2d at 1360.
14

This case is about whether the Defendant committed the acts alleged in the Superseding

15 Indictment. It is not about providing a forum for the Anonymous list of grievances. Defendant should
16 not be able to argue for acquittal based on the United States Governments policies related to Edward
17 Snowden, Julian Assange, or Wikileaks. If the defense makes arguments associating the prosecution
18 with extra-record government policies, the Court should interrupt the argument and correct it. See
19 United States v. Blixt, 548 F.3d 882, 890 (9th Cir. 2008) (When counsel argued the government was the
20 same government prosecuting the Iraq War, the district court, exercising considerable restraint in the
21 face of blatant jury nullification arguments, properly instructed the jury to disregard counsels
22 statements.). Not only should a judge interfere with an attorneys closing argument when it is legally
23 wrong, but [s]he should also limit, for example, attorneys remarks outside the record or unduly
24 inflammatory. See United States v. Sturgis, 578 F.2d 1296, 1300 (9th Cir. 1978).
25 //
26 //
27 //
28 //
U.S. MIL #7 TO BAR CERTAIN NULLIFICATION
EV. & ARG.

Case 2:13-cr-00082-KJM Document 74 Filed 09/09/15 Page 3 of 3


1

Any plea agreement offered by the United States in this case is also irrelevant and inadmissible.

2 What dispositions the Government might have offered years after the offense have nothing to do with
3 non-hearsay evidence of whether the Defendant committed the crimes. See United States v. Fell, 372 F.
4 Supp. 2d 773, 783 (D. Vt. 2005) affd, 531 F.3d 197 (2d Cir. 2008) (It is well settled that a prosecutors
5 belief in the defendants guilt is not relevant.).
6
7

Respectfully submitted,

8 Dated: September 9, 2015

BENJAMIN B. WAGNER
United States Attorney

9
10

By: /s/ MATTHEW D. SEGAL


MATTHEW D. SEGAL
Assistant United States Attorney

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
U.S. MIL #7 TO BAR CERTAIN NULLIFICATION
EV. & ARG.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 1 of 61

Exhibit A

1.
2.
3.
4.
5.
6.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 2 of 61

Analysis of Electronic Evidence from:

Tribune Company server logs


Overplay logs
Email provider records
Internet Service Provider (AT&T) records
Items recovered from Defendants digital devices; and
Internet Relay Chat logs recovered from search warrant in
Ohio

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 3 of 61

08/Dec/2010:18:11 Los Angeles Time

08/Dec/2010:18:00 Los Angeles Time


08/Dec/2010:18:00 Los Angeles Time
08/Dec/2010:18:01 Los Angeles Time
08/Dec/2010:18:05 Los Angeles Time
08/Dec/2010:18:05 Los Angeles Time
08/Dec/2010:18:05 Los Angeles Time
08/Dec/2010:18:10 Los Angeles Time

08/Dec/2010:17:57 Los Angeles Time


08/Dec/2010:18:00 Los Angeles Time

08/Dec/2010:17:57 Los Angeles Time*

On IRC channel #internetfeds:

AESCracked: It takes a while to grant one username


permission to every site
AESCracked: Im doing that now.
AESCracked:yes, those are the three cms that this user/pass
gives access to
AESCracked:user: anon1234
AESCracked:pass: common2
AESCracked: go fuck some shit up!
sharpie: fuck
sharpie: we're in
sharpie: thanks bro
Sabu: I am looking through these accounts. anon1234 stands
out like a sore thumb. we need to blend in
better amongst these other users
AESCracked: if you're on the assembler site, scroll down on
the left to "user preferences." click on that, then click "edit
users" when it says "find user," type "anon1234" into
username then click "find

*Converted to Los Angeles Time from Eastern Time throughout presentation.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 4 of 61

At the same time, Tribune Server Logs show


IP address 80.74.135.87 is connected

80.74.135.87 08/Dec/2010:17:57:04 - 0800] "


POST
/access/savegroups.ldap HTTP/1.1" 200 578
"https://assembler.tribuneinteractive.com/access/editgroups.ldap?username=anon1234" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

IP address 80.74.135.87 was logged onto the server and


referencing username anon1234 on December 8, 2010 at
about 5:57 PM (Los Angeles Time).

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 5 of 61

December 8, 2010, is the first appearance of the username


anon1234 and the IP address 80.74.135.87 in the Tribune
Server Logs.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 6 of 61

Uses London, United Kingdom local time.

UserName | NASIPAddress | AcctStartTime


| AcctStopTime
| FramedIPAddress | CallingStationId
keysjom | 80.74.135.87 | 2010-12-09 01:31:39 | 2010-12-09 03:57:46 | 10.12.0.10
| 75.53.168.11

From Overplay

IP 75.53.168.11

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 7 of 61

How Overplay Works

IP 80.74.135.87

08/Dec/2010:17:57 Los Angeles Time


08/Dec/2010:18:00 Los Angeles Time

08/Dec/2010:17:57 Los Angeles Time

UserName | NASIPAddress | AcctStartTime


| AcctStopTime
| FramedIPAddress | CallingStationId
keysjom | 80.74.135.87 | 2010-12-09 01:31:39 | 2010-12-09 03:57:46 | 10.12.0.10
| 75.53.168.11

80.74.135.87 08/Dec/2010:17:57:04 0800] " POST


/access/savegroups.ldap HTTP/1.1"
200 578 "https://assembler.tribuneinteractive.com/access/editgroups.ldap?username=anon1234" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 8 of 61

Time Comparison Between Tribune Server Logs,


Overplay Logs, and IRC Logs

08/Dec/2010:18:00 Los Angeles Time


08/Dec/2010:18:00 Los Angeles Time
08/Dec/2010:18:01 Los Angeles Time

AESCracked: It takes a while to grant one username


permission to every site
AESCracked: Im doing that now.
AESCracked:yes, those are the three cms that this user/pass
gives access to
AESCracked:user: anon1234
AESCracked:pass: common2
AESCracked: go fuck some shit up!

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 9 of 61

According to Overplay, who is keysjom?


Forename: Matthew
Surname: Keys
email: soundwavematthew@gmail.com
Signup Date: 2010-09-05 07:59:56
Signup IP: 75.53.168.11
Payment made via Google Checkout UK

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 10 of 61

mkeys and IP 75.53.168.11

At FOX40 News, Matthew Keys was assigned username mkeys.


mkeys was associated 184 times with IP address 75.53.168.11
between June 7, 2010 and October 21, 2010.
There were only 10 entries where mkeys did not use this IP on
the server.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 11 of 61

All mkeys entries had the same user agent string indicating use of an Apple computer using a Firefox browser.

80.74.135.87 08/Dec/2010:17:57:04 0800] " POST


/access/savegroups.ldap HTTP/1.1"
200 578 "https://assembler.tribuneinteractive.com/access/editgroups.ldap?username=anon1234" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

User Agent String

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 12 of 61

Screenshot of Firefox browser in use on an Apple


computer - found on Keys Apple laptop

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 13 of 61

Emails Sent to FOX40 News

The first suspicious email received, asserting that an email list had been stolen by
a person purporting to be foxmulder4099@yahoo.co.uk.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 14 of 61

Do the Tribune Server Logs Show Someone


Accessing the Email List?

75.53.168.11 - - [03/Nov/2010:02:38:44 -0700] "GET /rc/edit-newsletter.ui?id=543 HTTP/1.1" 200 3802


"https://assembler.tribuneinteractive.com/rc/list-newsletter.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8)
Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [03/Nov/2010:02:39:53 -0700] "GET /access/emailpage.ui?username=test1234 HTTP/1.1" 200 178316
"https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8)
Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [03/Nov/2010:02:39:53 -0700] "GET /images/buttons/ok.gif HTTP/1.1" 200 312
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test1234" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; enUS; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [03/Nov/2010:02:40:30 -0700] "GET /taxonomy/list-prodaffiliate-topicgalleries.ui HTTP/1.1" 200 63795
"https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8)
Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [03/Nov/2010:02:41:07 -0700] "GET /content/list-xmltemplate.ui HTTP/1.1" 200 28689
"https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8)
Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [03/Nov/2010:02:41:20 -0700] "GET /taxonomy/search-pa-topics.ui?productaffiliate=ktxl HTTP/1.1" 200 24523
"https://assembler.tribuneinteractive.com/taxonomy/list-prodaffiliate-topicgalleries.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; enUS; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

These are log entries from November 3, 2010, showing references to


emailpage and ktxl from an IP associated with mkeys, and the mkeys
user agent string. The associated username is test1234.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 15 of 61

Accessing the Email List?, contd.

"
75.53.168.11 - - [22/Nov/2010:03:02:36 -0800] "GET /access/emailpage.ui?username=test5678 HTTP/1.1" 200
187976 "https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel
Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:36 -0800] "GET /images/buttons/leftarrow.gif HTTP/1.1" 200 120
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:37 -0800] "GET /access/ldap/user/find.jsp HTTP/1.1" 200 3172
"https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:37 -0800] "GET /images/buttons/ok.gif HTTP/1.1" 200 312
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:37 -0800] "GET /images/buttons/rightarrow.gif HTTP/1.1" 200 120
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:43 -0800] "POST /access/ldap/user/finduser.ldap HTTP/1.1" 200 3478
"https://assembler.tribuneinteractive.com/access/ldap/user/find.jsp" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

These are more log entries showing references to emailpage from the IP
associated with mkeys, and the mkeys user agent string. The date is
November 22, 2010. The associated username is test5678.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 16 of 61

What IP addresses are related to getting


emailpage?

75.53.168.11 - - [03/Nov/2010:02:39:53 -0700] "GET /access/emailpage.ui?username=test1234 HTTP/1.1" 200 178316


"https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [03/Nov/2010:02:39:53 -0700] "GET /images/buttons/ok.gif HTTP/1.1" 200 312
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test1234" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:36 -0800] "GET /access/emailpage.ui?username=test5678 HTTP/1.1" 200 187976
"https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:36 -0800] "GET /images/buttons/leftarrow.gif HTTP/1.1" 200 120
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:37 -0800] "GET /images/buttons/ok.gif HTTP/1.1" 200 312
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:37 -0800] "GET /images/buttons/rightarrow.gif HTTP/1.1" 200 120
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

A search of the entire database for the term emailpage between


June 7, 2010 and December 1, 2010 shows only one IP address 75.53.168.11.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 17 of 61

Only one IP address in the database appeared to take the email


database belonging to Fox40 News.

IP address 75.53.168.11 which was previously associated


with Matthew Keys.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 18 of 61

Foxmulder4099 emails KTXL - FOX40 News

The first suspicious email received, asserting an email list had been stolen by
a person purporting to be foxmulder4099@yahoo.co.uk.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 19 of 61

IP address 91.214.168.172 was also used to access the


foxmulder4009 email account

December 3, 2010
December 4, 2010
December 4, 2010
December 4, 2010
December 5, 2010
December 5, 2010
December 6, 2010
December 6, 2010

10:47 PM
1:45 AM
5:35 AM
4:28 PM
2:07 AM
8:46 PM
1:53 AM
6:48 AM

According to Yahoo! Inc., IP address 91.214.168.172 logged


into its email server to access the foxmulder4009 account on:

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 20 of 61

IP address 91.214.168.172 alternates between logging into the Tribune server and the
foxmulder4099 email account.

December 3, 2010 22:47 PM - IP 91.214.168.172 logs into foxmulder4099 e-mail account.


December 4, 2010 1:45 AM- IP 91.214.168.172 logs into foxmulder4099 e-mail account.
91.214.168.172 - - [04/Dec/2010:02:41:41 -0800] "GET / HTTP/1.1" 200 1781 "-" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
December 4, 2010 5:35 AM- IP 91.214.168.172 logs into foxmulder4099 e-mail account.
December 4, 2010 16:28 PM- IP 91.214.168.172 logs into foxmulder4099 e-mail account.
91.214.168.172 - - [04/Dec/2010:16:31:33 -0800] "GET / HTTP/1.1" 200 1781 "-" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
December 5, 2010 2:07 AM- IP 91.214.168.172 logs into foxmulder4099 e-mail account.
December 5, 2010 20:46 PM- IP 91.214.168.172 logs into foxmulder4099 e-mail account.
91.214.168.172 - - [05/Dec/2010:21:07:00 -0800] "GET / HTTP/1.1" 200 1781 "-" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
December 6, 2010 1:53 AM- IP 91.214.168.172 logs into foxmulder4099 e-mail account.
91.214.168.172 - - [06/Dec/2010:04:37:49 -0800] "GET /common/welcome.jsp HTTP/1.1" 200 1325
"https://assembler.tribuneinteractive.com/access/loginmodule.ldap" "Mozilla/5.0 (Macintosh; U; Intel
Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
December 6, 2010 6:48 AM- IP 91.214.168.172 logs into foxmulder4099 e-mail account.
91.214.168.172 - - [06/Dec/2010:21:18:09 -0800] "GET /stylesheets/ui.css HTTP/1.1" 200 7252
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 21 of 61

Observation

IP 91.214.168.172 was used to access both the Tribune server


and the foxmulder4099 email account, on one occasion
accessing both within less than four minutes.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 22 of 61

User Agent String is Same as mkeys

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;


rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 23 of 61

December 6, 2010
09:53 AM 12 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-06 10:05:49 | 2010-12-06 10:13:35 | 10.10.0.234

December 6, 2010
04 46 AM 2 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-06 04:48:48 | 2010-12-06 05:05:41 | 10.10.0.234

December 5, 2010
10 07 AM 15 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-05 10:22:09 | 2010-12-05 10:27:44 | 10.10.0.234

December 5, 2010
00: 28 AM 15 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-05 00:43:06 | 2010-12-05 00:57:58 | 10.10.0.234

December 4, 2010
13: 35 PM 12 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-04 13:47:49 | 2010-12-04 14:01:09 | 10.10.0.234

December 4, 2010
09: 45 AM - 10 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-04 09:55:00 | 2010-12-04 10:46:11 | 10.10.0.234

| 75.53.168.11

| 75.53.168.11

| 75.53.168.11

| 69.106.226.212

| 69.106.226.212

| 69.106.226.212

| 69.106.226.212

December 4, 2010
07: 04 AM - in Range with 11 MIN TO SPARE or 14 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-04 06:29:44 | 2010-12-04 07:15:17 | 10.10.0.234 | 69.106.226.212
keysjom | 91.214.168.172 | 2010-12-04 07:18:36 | 2010-12-04 07:25:01 | 10.10.0.234 | 69.106.226.212

According to Yahoo, IP address 91.214.168.172 logged into its email server.


According to Overplay this IP was used by keysjom.
There is a time difference of about 15 minutes between the two computer systems*

IP address 91.214.168.172 was used by keysjom

December 6, 2010
14 48 PM - -13 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-06 15:01:06 | 2010-12-06 15:07:31 | 10.10.0.234

| 69.106.226.212

* If 15 min is subtracted for each log entry of Overplay computer 91.214.168.172, the times match. So, for this IP the clock
should be subtracted by 15 minutes.

December 4, 2010
06:47 AM In Range with 28 MIN TO SPARE
keysjom | 91.214.168.172 | 2010-12-04 06:29:44 | 2010-12-04 07:15:17 | 10.10.0.234

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 24 of 61

The e-mailer used different email addresses,


including cancerman4099@yahoo.co.uk.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 25 of 61

Cancer Man sent another email to Fox 40 customers

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 26 of 61

One e-mail stated watch yourselves fox 40 and


referenced Matthew Keys

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 27 of 61

Another email from Cancer Man mentioned a


determined insider and going rogue

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 28 of 61

Who was cancerman4099?

On December 11, 2010 at 19:25 GMT, IP address


91.214.168.172 logged into the email account
cancerman4099@yahoo.co.uk.

Overplay Server IP address 91.214.168.172 was in


use by IP address 75.53.171.204 at that time.

| keysjom | 91.214.168.172 | 2010-12-11 16:57:00 | 2010-12-11 20:25:55 | 75.53.171.204*

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 29 of 61

AT&T customer soundwavematthew@att.net

According to AT&T, its customer was using IP


address 75.53.171.204 from 12/8/2010 to
4/28/2011.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 30 of 61

AT&T Customer Records

Matthew Keys was assigned this IP address at


his home in Sacramento.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 31 of 61

Summary

On December 11, 2010, Matthew Keyss residential AT&T IP


address connected to Overplay and was assigned IP address
91.214.168.172. The Overplay IP address 91.214.168.172 was
then used to check the cancerman4099@yahoo.co.uk email
account.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 32 of 61

What Happened to Samantha Cohens account,


sscholbrock?

Samantha Cohen was an employee at FOX40 News. She used


account sscholbrock.

Between December 6 and 8, 2010, she had trouble accessing


her account. Her password did not seem to be working even
after it was changed.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 33 of 61

Samantha Cohens account, contd.

This entry from the early morning of December 6, 2010, shows


the account being edited.

91.214.168.172 - - [06/Dec/2010:04:38:17 -0800] "POST /access/saveuser.ldap HTTP/1.1" 200 584


"https://assembler.tribuneinteractive.com/access/ldap/user/edituser.ldap?username=sscholbrock" "Mozilla/5.0 (Macintosh; U; Intel
Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8

About four hours later, Cohen (sscholbrock) reported she was


trying to log in and her password did not work. She asked for it
to be reset and it was.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 34 of 61

Samantha Cohens account, contd.

Then on December 8, 2010, the account is edited again.

91.214.168.172 - - [08/Dec/2010:09:08:37 -0800] "POST /access/saveuser.ldap HTTP/1.1" 200 584


"https://assembler.tribuneinteractive.com/access/ldap/user/edituser.ldap?username=sscholbrock" "Mozilla/5.0 (Macintosh; U; Intel
Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

About two hours later, Cohen (sscholbrock) reported her new


password had stopped working and asked that it be reset. It
was. A new account, sscholbrock2 was also created.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 35 of 61

Samantha Cohens account, contd.

Then on December 14, 2010, both accounts are edited.

91.214.168.172 - - [14/Dec/2010:07:44:56 -0800] "POST /access/saveuser.ldap HTTP/1.1" 200 6652


"https://assembler.tribuneinteractive.com/access/ldap/user/edituser.ldap?username=sscholbrock2" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
91.214.168.172 - - [14/Dec/2010:07:45:01 -0800] "POST /access/saveuser.ldap HTTP/1.1" 200 7576
"https://assembler.tribuneinteractive.com/access/ldap/user/edituser.ldap?username=sscholbrock" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

About two hours later, Cohen reported that her new account
and old account were no longer accepting her log on
information.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 36 of 61

In summary,

On three occasions, the user from IP address 91.214.168.172


made changes to Cohens accounts which resulted in her being
locked out.

In each instance, the mkeys user agent string was present.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 37 of 61

After LA Times is Attacked, Keyss AT&T IP address


continues to appear in the Tribune Server logs

75.53.171.204 - - [02/Jan/2011:05:02:59 -0800] "GET / HTTP/1.1" 200 1781 "-" "Mozilla/5.0 (Macintosh; U;
Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:02:59 -0800] "GET /stylesheets/ui.css HTTP/1.1" 200 7252
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:00 -0800] "GET /favicon.ico HTTP/1.1" 200 3574 "-" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:00 -0800] "GET /images/buttons/login.gif HTTP/1.1" 200 334
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:00 -0800] "GET /images/ti.jpeg HTTP/1.1" 200 17924
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:03 -0800] "GET /favicon.ico HTTP/1.1" 200 3574 "-" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:04 -0800] "POST /access/loginmodule.ldap HTTP/1.1" 200 1859
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:07 -0800] "GET /favicon.ico HTTP/1.1" 200 3574 "-" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 38 of 61

IP address 75.53.171.204, appears in the Tribune


Server Logs in January 2011

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 39 of 61

IP addresses 75.53.171.204 and 75.53.168.11

"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;


rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 - still containing
the mkeys user agent string

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 40 of 61

Where Else Do We See IP address 75.53.171.204?

From at least December 12, 2010 through about January 5,


2011, IP address 75.53.171.204 is associated with the
nickname AESCracked on IRC Channels.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 41 of 61

Here are some samples:

Dec 12 17:31:02 * *** Notice -- Client connecting at lexus.anonops.eu: AESCracked__ (AESCracked@75-53-171-204.lightspeed.nscrca.sbcglobal.net)

Dec 13 03:09:48 * *** Notice -- Client exiting at fancy.anonops-irc.com: AESCracker!AESCracker@75-53-171-204.lightspeed.nscrca.sbcglobal.net (Ping timeout)

Dec 15 13:21:53 * *** Notice -- Client connecting at osiris.anonops.net: AESCracked (AESCracked@75-53-171-204.lightspeed.nscrca.sbcglobal.net)


Dec 27 21:19:45 * *** Notice -- Client connecting at irc.anonops.co.uk: AESCracked (AESCracked@75.53.171.204)
---------------------------------

Jan 04 14:37:56 <AESCracked> I cannot get in to internetfeds :(


Jan 04 14:37:58 <AESCracked> help me for raeps plz.
Jan 04 14:38:09 * [AESCracked] (~AESCracke@my.vhost): AESCracked
Jan 04 14:38:09 * [AESCracked] is using modes +iwrxt
Jan 04 14:38:09 * [AESCracked] is connecting from *@75-53-171-204.lightspeed.nscrca.sbcglobal.net 75.53.171.204
----------------------Jan 04 21:52:39 <Global> NickServ: AESCracked!AESCracked@75-53-171-204.lightspeed.nscrca.sbcglobal.net identified for nick AESCracked
Jan 04 21:52:44 <Global> AESCracked joins #internetfeds

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 42 of 61

Search Warrant Results

Matthew Keyss computer had this on it:

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 43 of 61

It is a screen shot containing items from the Tribune


Company Content Management Server

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 44 of 61

Here are some details about the screenshot.

The file was called:

The file was created on:

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 45 of 61

What do the Tribune Server Logs from this date and


time contain?

IP address 91.214.168.172 was logged on with account


test1234.

| 75.53.171.204

91.214.168.172 - - [11/Dec/2010:11:32:26 -0800] "GET /access/ldap/user/edituser.ldap?username=test1234 HTTP/1.1" 200 7363


"https://assembler.tribuneinteractive.com/access/ldap/user/finduser.ldap" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8)
Gecko/20100722 Firefox/3.6.8"

The User Agent String was the same as before.

keysjom | 91.214.168.172 | 2010-12-11 16:57:00 | 2010-12-11 20:25:55 | 10.10.0.234

From Overplay:

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 46 of 61

Summary

The image depicted data that came from the Tribune Server on
December 11, 2010.
The image was obtained by the user of IP address
91.214.168.172.
IP address 91.214.168.172 was assigned to Matthew Keys
(keysjom) who accessed it from his home in Sacramento.
The image was found on Matthew Keyss computer.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 47 of 61

Matthew Keyss computer had this on it:

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 48 of 61

The picture was created on Matthew Keys


computer:

The time stamps show


this picture was created on
December 15, 2010 at 4:32 AM
Los Angeles Time.

What else is happening at this time?

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 49 of 61

As this Screenshot from Keyss Computer Shows,


AESCracked Was Chatting With Sharpie
FBI Note: On 8/13/2015, went to
website.
Picture matches previous slide.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 50 of 61

What else was happening at this time?

This picture was also created a few minutes later.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 51 of 61

The chat continues

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 52 of 61

From the Tribune logs at this same time

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 53 of 61

From #internetfeds IRC Channel

Dec 20 17:13:19 <kayla> :o?


Dec 20 17:13:28 <Chronom> :O
Dec 20 17:14:15 <AESCracked> o.O
Dec 20 17:14:46 <Chronom> Still sellin' those emails, AESCracked?
Dec 20 17:14:57 <AESCracked> I haven't sold an e-mail list to
anyone dude.
Dec 20 17:15:16 <Avunit> Whos in the market for e-mails?
Dec 20 17:16:24 <root`work> spamz0rs
Dec 20 17:16:39 <AESCracked> I has emails to give to teh spamz0rs.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 54 of 61

#Target

Dec 08 20:53:12 <Random`> Hit authorize.


Dec 08 20:53:13 <AESCracked> if you want to attack fox news, pm me. i
have a user/password for their cms
Dec 08 20:53:15 <Satori> By attacking paypal, we ruin our reputation. I say
we attack the payment servers secure.whatever for both paypal and visa
Dec 08 20:53:17 <spac> dowjones=publicity
Dec 08 20:53:18 <Minilogue> Vote authorize.net - 2 . We could hit visa
Where it hurts!.
Dec 08 20:53:18 <montezuma> oh.
Dec 08 20:53:18 <WiKiLeAdEr> be intelligent not just revengeful
Dec 08 20:53:20 <toxology> anondesu: But the public does not see

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 55 of 61

From #OperationPayback IRC Channel

Dec 10 21:41:10 <mauro> dont attack media!


Dec 10 21:41:10 <Anon123456789> i can't get i
Dec 10 21:41:11 <Anon123456789> n
Dec 10 21:41:12 * AESCracked suggests targeting FOX News
Dec 10 21:41:13 <mib_3mwhbt> 178.63.172.193 hive is down

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 56 of 61

From #command IRC

Dec 08 20:53:38 <iowa> lithium it hsoul d be telling you which


chan is +N
Dec 08 20:53:42 <Isis> its -N now
Dec 08 20:53:44 <iowa> leave that channel
Dec 08 20:53:55 <ToMz> (AESCracked) *pm me for fox news
password into their cms*
Dec 08 20:54:04 <Isis> wtf Dec 08 20:54:10 <ToMz> wat do ^

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 57 of 61

#OperatonPayback

Dec 09 07:54:12 * EvilBoat has kicked teddde from #OperationPayback (Watch your language!)
Dec 09 07:54:12 <odalfe> !botnum
Dec 09 07:54:13 * EvilBoat has kicked odalfe from #OperationPayback (Watch your language!)
Dec 09 07:54:15 <paull> can someone pm me what has happened the last about 5 hours please Dec 09 07:54:15
<amanikos> paypal ha
Dec 09 07:54:17 <AESCracked> I've already given Ops the user/pass to several FOX websites.s slowed down or is
it me?
Dec 09 07:54:17 <aveit23> !botnum
Dec 09 07:54:18 * EvilBoat has kicked aveit23 from #OperationPayback (Watch your language!)
Dec 09 07:54:18 <ziltoid> only fire where we need to, we'll probably be jumped back to mastercard.com later
Dec 09 07:54:19 <Anonlolle> Fox News is just for the lulz and the white trash trailer rage
Dec 09 07:54:21 <JAM> !botnum Dec 09 07:54:21 * EvilBoat sets ban on *!*@IT.IN
Dec 09 07:54:21 * EvilBoat has kicked JAM from #OperationPayback (Watch your language!)
Dec 09 07:54:21 <gewgahs_> can anyone link me to instructions for hiding LOIC from my ISP? I've got plenty of
bandwidth to spare Dec 09 07:54:21 <calatalee> >####On behalf of #propaganda please spread
http://pastebin.com/XYSN27EK to your local news media####< Dec 09 07:54:22 <AESCracked> The backend of
their CMS.

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 58 of 61

#OperationPayback

Dec 14 15:29:46 <Raphael> works for chrome xp


Dec 14 15:29:49 <n3ot0xin> http://boards.808chan.org/tpb/
Dec 14 15:29:50 <AESCracked> Anyone interested in defacing FOX, LA Times?
Dec 14 15:29:55 <Raphael> no media
Dec 14 15:29:58 <Snotbox> What's the point of ddosing aklagare.se?
Dec 14 15:29:58 <n3ot0xin> yes AES
Dec 14 15:30:07 <rand0m> lol ... AESCracker ... you little angry man
Dec 14 15:30:08 <AESCracked> I have users/pass into their CMS.
Dec 14 15:30:10 <God> http://www.limeradio.net/listen/wmp :: Radio:Payback -- KORAX
LIVE ON AIR
Dec 14 15:30:10 <God> http://www.limeradio.net/listen/wmp :: Radio:Payback -- KORAX
LIVE ON AIR Dec 14 15:30:11 <God> http://www.limeradio.net/listen/wmp :: Radio:Payback
-- KORAX LIVE ON AI

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 59 of 61

#OperationPayback

Dec 10 21:43:57 <Mike3620> ^^ an example


Dec 10 21:43:58 <JulianAssange> Julian Assange here
Dec 10 21:43:58 <AESCracked> FOX News is not media. it's
"infotainment" for inbreds. I say we target them.
Dec 10 21:43:58 <stilgar> terrorist terrorist terrorist.... every
force that has voice it's own is called terrorist by the
establishment

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 60 of 61

#Internetfeds

Dec 09 18:31:52 * Now talking on #internetfeds


Dec 09 18:31:52 * Topic for #internetfeds is: Welcome. We are the Internet feds. | Everything that is
shared here is private and must remain in this channel unless stated otherwise. |
Dec 09 18:31:52 * Topic for #internetfeds set by xS at Thu
Dec 09 14:59:49 2010 Dec 09 18:31:53 * LOIC_UIRXWT gives channel operator status to iowa
Dec 09 18:32:01 <IOU> Can we remove the auto invite on my nick?
Dec 09 18:33:57 <AESCracked> Yet another reason the Times must be demolished.
Dec 09 18:33:57 <AESCracked> http://latimesblogs.latimes.com/the_big_picture/2010/12/why-thewikileakers-are-not-quite-rosa-parks.html
Dec 09 18:35:48 * LOIC_UIRXWT invited kayla into the channel.
Dec 09 18:35:54 * LOIC_UIRXWT gives channel operator status to kayla
Dec 09 18:36:03 <kayla> holy fucking cock :3 Dec 09 18:36:12 <kayla> i been trying for ages to get
tonnected ;_;
Dec 09 18:36:24 <kayla> "MAX CONNECTION ERROR" :(

Case 2:13-cr-00082-KJM Document 67-1 Filed 09/09/15 Page 61 of 61

#OperationPayback

Dec 09 08:41:19 <pongdu> where is target?


Dec 09 08:41:20 <ruimm> still bombarding
Dec 09 08:41:22 <[Z]Anon> No one's annonimous here.
Dec 09 08:41:22 <lulzzzzz> Schnecke> WHAT ?
Dec 09 08:41:23 <anon_666> upgoat/repost -->
http://www.reddit.com/r/reddit.com/comments/eiwte/operation_payback_man
ifesto_from_anonymous_indybay/
Dec 09 08:41:23 * PD_ is now known as PD
Dec 09 08:41:24 <AESCracked> Members of the media: I am a former journalist.
Dec 09 08:41:24 <wooshka> !hivestatus

- 1 of 86 -72-1 Filed 09/09/15 Page 1 of 86


Case 2:13-cr-00082-KJM Document

FD-302 (Rev. 5-8-10)

O FFICIAL R ECORD

Document participants have digitally signed.


All signatures have been verified by a
certified FBI information system.

FEDERAL BUREAU OF INVESTIGATION


Date of entry

08/05/2013

SA Cauthen listened to evidence items 1D1 and 1D2 containing recordings of


an interview of Matthew Keys. SA Cauthen prepared the following based on
his review of the items:
PARTICIPANTS
MK: Matthew Keys
GA: Special Agent Gabriel F. Andrews
JC: Special Agent John M. Cauthen
ABBREVIATIONS
UM1-14: Unknown Male Voice #1 through #14
UMS:Unknown Male Voices
UI:Unintelligible
JC: I think youre aware of what were going want to address. But you know
[UI].
MK: Does the door need to be open?
JC: No, thats why we want to go a different [UI]. This is a copy of your
search warrant. Ok.
MK: Ok.
JC: Were going to give you plenty of time to read that. Were going to
answer all of your questions. Before we do, even though were not going to
arrest you, uh today, we are going to go through our standard Miranda
warning. So, well read that to you.
GA: So lets do that right now, just get it out of the way. So, this is
basically [UI]. Before we talk to you, you have the right to remain silent.
Anything you say can be used against you in a court. You have the right to
talk to a lawyer for advice before you ask questions. You have a right to a

Investigation on
File #
by

10/04/2012

at

Secaucus, New Jersey, United States (, Other (Review Tape


Recordings from Interview on 10/04/2012))

288A-SC-45485, 288A-LA-258500

Date drafted

07/18/2013

CAUTHEN JOHN M

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not
to be distributed outside your agency.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 2 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

2 of 86

talk to a lawyer for advice before you ask questions. You have a right to a
lawyer during your questioning. If you cant afford a lawyer, one will be
appointed to you before any questioning. And, if you decide to answer
questions now, at any point, you have the right to stop. Ok?
MK: Yea.
GA: And, this is all something wed read if you were to be under arrest.
Again, youre not. [UI]
MK: Before we all start.
JC: Tell you what, were going to answer all of your questions. I can tell
youre kind of [UI] unease a little bit.
MK: I had people wake me up in the middle of the night. [Laughter]
JC: And, and thats completely understandable. So, were just, were just
going to [UI]. Uh, by the way, Im John Cauthen. You probably recognize
[UI]
MK: Matthew. I have spoken with you before.
JC: You have.
MK: Yes, I have.
JC: So, Ill tell you what.
MK: Four stories and not.
JC: What we want to do here is put you at ease. Answer all of your
questions.
MK: Mmm hmm.
JC: And, uh, and I think we want to work with you on this, ok? Cause I
think you have a lot of things you want to tell us, and well explain
everything to you. Alright?
GA: [UI]
JC: What we want to do is
MK: Ummm.
JC: -- take you to a place where youre not with your roommates and [UI]
for you.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 3 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

3 of 86

for you.
MK: You know what, we can do either. It doesnt matter to me.
JC: Ok, well, what are you more comfortable with?
MK: I am
JC:Ill tell you what, you know what. Lets go to another location. Just to
make it easy for . They got another room, I think. And then
MK: I, I think I would rather be here.
JC: Ok.
MK: If thats ok.
JC: Ok, then thats what we want to do. Alright. You want to do it in this
room? Or?
MK: We can do it in here if you like as long as I dont have anything to be
worried about. And, I dont, I want to make sure you guys dont have
anything youre worried about.
JC: Well, uh
MK: Well be ok.
JC: I think we cleared the room. Do you have anything dangerous in the room
or anything?
MK: No.
JC: Ok. Do you have a chair or something we can sit on or?
MK: I dont. We can grab one from the dining room.
JC: Thank you. Lets get some chairs. Im going to take my jacket off if
thats ok.
MK: And, I apologize for the mess.
JC:Oh, I understand. And, youve only been here about a month as I
understand? Is that right?
GA: [UI]
JC: So, uh.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 4 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

4 of 86

JC: So, uh.


[UI Portion -- 0:00:19 seconds]
JC: So, you know why were here, right?
MK: Yes, I know. [UI]
JC: I know, Im, Im sorry. And, you know, I dont want to blow this thing
out of proportion either. I mean
MK: You have a job to do, and I have a job to do so I understand.
JC: Ok. Heres the thing. Uh, I think after you go through that. Im going
to answer all your questions and my partner here, Gabe, hes from Los
Angeles FBI.
MK: Hi Gabe. Matthew.
GA: How you doing Matt?
JC: Hes, were going to be as helpful as we can [UI] which I know is
difficult for you.
MK: Can I take a look at this real quick?
JC: Yea.
MK: I just
JC: Yea, Ill talk to you as were going.
MK I just want to scan through it.
JC: Yea. So, uh GA: One of the things I wanted to bring up to you, Im sure you recognize
this.
MK: Yes, I have a copy of it on my desk.
GA: Nice. Ive been reading through it a bit myself. Uh, you know I saw
the, the Twitter post where you mentioned the book and gave her a plug, and
she responded and
MK: [UI]?
GA: Yea.
MK: Yea.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 5 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

5 of 86

MK: Yea.
GA: In the back she actually, as you mentioned here briefly, that, you know
Keys was invited to observe the goings on in the InternetFeds room December
2010 to January 2011 using the name AESCRACKED. You, uh, provided her a
number of logs to help her with [UI].
[UI Portion 00:00:09 seconds]
GA: -- She picked it up from your logs.
MK: I think she picked it from the logs.
JC:So, you just gave her the raw logs showing it was AESCRACKED and all the
chats with everything?
MK: I gave her some of the raw chat logs, correct.
JC: Ok. Oh, some of them. So, you didnt give her everything? Alright.
MK: I dont remember if I gave her everything that I had.
JC: Alright.
MK: I took quite a few logs while I was, while I was in the chat room.
JC: Well, weve got a number of the logs in there, uh, as well, that youre
going to be able to read.
MK: I saw some of those [UI].
JC: I think thats from your But, weve actually got the raw cuts. We got
the whole thing, essentially is the bottom line. Uh, your conversation.
GA: When you were doing this, did you use other usernames other than
AESCRACKED?
MK: I may have. To be honest with you, I dont remember.
GA: You dont recall off the top of your head?
MK: I, I It happened a year and a half ago.
JC: Yea.
GA: I understand.
JC: Well, heres what we want to do here today, Matt. We want your help in
terms of

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 6 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

6 of 86

JC: Well, heres what we want to do here today, Matt. We want your help in
terms of
MK: There were some on one page that I saw here. The first or second page
and [UI].
JC: Theres a probable cause statement that shows some of the logs. This is
not everything obviously. And, items that were going to be taking.
MK: These are not me.
JC: Ok.
MK: Um.
GA: Right.
JC: Well, thats why we want And, some of those people you actually did
talk to those people and thats a large part of why were here today.
MK: Like some of these names I dont even recognize.
JC: And, thats why we want to talk to you, too. Because, you know, there
still are people out there.
MK: Yea.
JC: And, youve heard about Sabu, and all of those guys that have been
wrapped up and a lot of the folks overseas. And, you did have some
involvement with those folks so were going to ask for two things. One is
were going to ask for your help in what you can help us with on those
folks. Two is and this is extremely important and were going to ask for
extreme candor. I mean, we want you to be truthful and not mislead us. And,
I dont think youre going to want to do that.
MK: Define extreme candor.
JC: Well, not trying to lie. I dont think youre going to do that. You
dont seem like the kind of guy who wants to do that, and I think what
happened in the past was just a mistake and youre going to want to move
past that and help us out. Am I, am I right in that?
MK: Yea.
JC: Ok. So, so that
MK: What are the consequences?
JC: Well, I mean, you can read that I dont, I dont know what the

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 7 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

7 of 86

JC: Well, I mean, you can read that I dont, I dont know what the
consequences are. I mean, heres the bottom line. Well cover the whole
thing, but the bottom line is weve got two issues. Uh, the first issue is
how you helped these guys in Anonymous. They actually did cause some
damage. No, you didnt actually do the hack, but you did give them the
passwords to Fox, to the CMS. And, and thats an issue we got to address.
And, so were going to expect you be candid about that because we got those
records, and we can prove that. You understand?
GA: Youll be able to keep this, by the way. So this [UI].
JC: Yea, this is your copy.
GA: But, youll have this when we leave.
JC: So
MK: Remind me again what your name was?
GA: Its Gabriel.
JC: Its Gabe. Gabriel.
JC: Im John.
JC: Youre not going to forget that.
MK: No, your name I know who you are.
JC: I know.
MK: Yea.
JC: So
MK: What do you do Gabriel?
GA: Um, same thing as John, basically.
MK: Ok.
JC: But, heres the thing, I mean we, we already know in the scheme of
things where you stand and how you can help us, and thats all were going
to ask you. Just, you know, how can you help us. Were going to ask for,
you know, we got a search warrant actually to get all of the logs off your

computer. Ok. But, its going to help us a lot if you just tell us where

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 8 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

8 of 86

computer. Ok. But, its going to help us a lot if you just tell us where
those logs are. If theres more. If youve got them in the cloud, or if
youve just got them on the computer.
MK: I can give you, um, as far as. There, there is a hard drive that, um,
has a zip file with the logs that I kept that I, I remind, you know, I
JC: Ok. Yea.
MK: This computer I didnt own at the time if you want to take a look at
it.
JC: Alright.
MK: I mean youre going to anyway. Uhm
JC: Is the zip file encrypted, or?
MK: No.
JC: So, its a straight. Where is that hard drive?
MK: I believe its in there.
JC: Ok. So, you know what were going to do.
MK: And, I can show you on the computer how to get access to those.
JC: Ok. Well, trust me when I say I dont want to turn your life upside
down and make this more difficult for you than it is cause I understand
that youre probably mildly upset. But, well work with you on it, ok? To
the extent that we can leave you with this computer, well do that. And,
well get those logs because thats all were really asking for and then
your cooperation. And, then finally, uh, you know, we dont want any
minimization in terms of what your role was, you know. Sometimes people do
have a tendency to, uh, kind of minimize what they did. And
MK: I dont know anything about computer hacking.
JC: I know.
MK: Thats the [UI].
JC: And, we believe that. We believe that. Having said that, it did happen,
and it wouldnt have happened without your help. So, we need you to take

responsibility in the sense that if you do try to kind of say, well, I

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 9 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

9 of 86

responsibility in the sense that if you do try to kind of say, well, I


didnt do it, or I didnt have a significant role in it. Still 6 oclock?
What time you got to go to work?
MK: Uh, I had to be up at 8.
JC: Alright, so we got some time.
MK: Yea.
JC: But, what Im saying is, you know, were going to cover everything from
the time you left Fox News, ok? All the way through. And, at the end of the
day, you know, we just want you to [UI] and be truthful about everything.
And, and to the extent that you do feel some remorse, honestly Matt, that
goes a long way with people who look at people like yourself who are
normal, decent people that just made a mistake. And, you had circumstances
at the time that might have caused that mistake, and thats understandable.
So, I think you are going to be remorseful. I think youre going to tell
the truth and, uh, and, thats all worthy. Ok?
MK: Yea.
GA: [UI] you can help us catch some of the other guys too.
JC: Which is
MK: The concern that I have is more or less for my career. You know, I know
how these things
JC: Were going to work with you to the extent that we can. Were not here
to harm your career. Ok? Our goal is to obtain the truth.
MK: Right.
JC: Ok? So, like I said today. Were going to leave here today, and we are
and youre going to leave here today. Youre not going to jail today. Ok?
MK: Key word being today.
JC: Well, you know, even I cant predict the future. But, heres what I can
predict. Uh, you know, knowing your role in it, unless there is something I
dont know, ok, because as far as we can tell at this point, and you know,
were going to find it out as we look at your stuff and your computers even
more I guess if theres something we dont know. But, we know what happened
at Fox40 News with the emails and essentially the CMS server, your access
of passwords, and your involvement with Anonymous. Ok.
MK: Which was minimal, at, at best.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 10 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

10 of 86

MK: Which was minimal, at, at best.


JC: You were not a hacker, per se, but at the end of the day, you did take
emails from Fox40 that you shouldnt have, ok. And, screw with them and
cause them consternation.
MK: Hey, I didnt really take
JC: Well, stop for a second. And, then, more importantly, and the real
reason were here is giving the passwords to those guys that caused the, to
the, uh, that ultimately resulted in the hack at the LA Times. You didnt
do the hack, but you gave them the passwords. And, you cant unwind that.
And, whatever the moment or cause, I, we can, we can understand what
happened.
MK: Yea
JC: Alright. So, thats essentially is there anything else that, beyond
that?
MK: No. I didnt have access to anything else.
JC: Ok. Well, Gabe is going I am going to go get
MK: My involvement was, involvement with them, ended kind of rough.
JC: Yea, I understand. And, thats probably to a large extent why we even
ended up here today because it was a contentious relationship with, with
them, and its understandable.
MK: Well, they were upset that stuff was getting out that they didnt want
to get out. I mean, as youre probably aware.
JC: Sure. I dont know all of the details so, were going, I mean what we
would like to do
MK: I, unfortunately, dont remember all of the details.
JC: Well refresh your memory of what we know, and to the, and uh, is it ok
if we take some notes?
MK: Yea.
JC: Ok. Gabe, Im going to get a chair for you to sit in and make some
notes if thats ok.
GA: Yea, thank you.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 11 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

11 of 86

JC: Ill be right back.


JC: Oh, I got the wrong room.
JC: This is going to go pretty easy. He, uh, hes got an Apple thats on,
its not encrypted. Hes cooperating, but he says this things new. So,
what I might do is just, uh. I dont think were even going to need it.
Hes got a hard drive which has all his stuff on it.
UM1: Oh.
JC: So, Im thinking we preview that on site. If its got all the logs we
take that hard drive.
UM1: Ok.
JC: So I would fire up a laptop. Its a zip file.
UM1: Do you have a Can you give me, can you bring out the hard drive? Or

JC: Yea.
UM1: Find out what the interface is just so I know.
JC: Yea.
UM1: [UI]
JC: Ill get the [UI]. Ill get the hard drive and bring it out.
UM1: And, theres another Apple in the closet.
JC: Oh ok. [UI] Its, its going to be fine.
UM2: [UI]
JC: Oh yea, Ill ask him if he wants [UI]. So, what do we got in the
fridge? Coke, something?
UM2: [UI]
JC: Alright.
UM2: [UI]
JC: Alright.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 12 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

12 of 86

UM2: [UI]
JC: Sorry about that. Did you want something to drink, Matt? Or some water?
I know theres a Coke in the fridge or something.
MK: No, but in the fridge theres a water jug thats got a red cap on it.
JC: Can I get that for you?
MK: Yes, please.
JC: Alright. Water bottle in the fridge, red cap.
[Pause 00:00:36 seconds]
MK: [UI] water.
JC: [Laughter]
MK: [UI]
(FBI Note: About this time the second recording commenced Evidence Item
1D1)
JC: Its alright.
MK: Um, otherwise, right now I probably would have helped. Um. One of the
things that I did before I joined Reuters was I invited him to have coffee.
Tribune Company [UI] Reuters client. Um, I decided that if I were to get
the job at Reuters I would want there to be some closure and as little
animosity as possible. So, I invited him out, and we didnt talk, you know,
about anything other than the industry, what was happening at the station,
what was going on with what I was doing. At the time I worked at ABC. And,
um, I think it was very cordial. We left on good terms. I sent him a few
emails and havent heard from him most of the time. Uh, but, some of the
times he was very responsive. You know, I told him, I sent him an email
when I started at Reuters saying this is my mailing address, Im still
getting mail to my old address, you need to have these for your records.
GA: Ok.
MK: Um, so I would say that when my employment ended, it ended kind of
gruff. And, then, it eventually, you know. It got better. Time, time makes
everything better. So
GA: Sure. Ok. So, that happened about when then? You came out here sometime
around January, right?

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 13 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

13 of 86

MK: January 18.


GA: So, you sat down with him about January of this year.
JC: And, who was that?
MK: Brandon.
JC: Ok.
MK: I sat down with him, um, middle of December of the previous year when I
was still living in California. And, that was the only time that he and I
sort of had a face-to-face after I had left Fox. And, like I said, it was a
very pleasant meeting. We were very cordial. Um, if you were some stranger
looking at us at the coffee shop, you would never have known that you know
he had let me go.
GA: So, not too many cups of hot coffee thrown at one another.
MK: No, it was very nice. Brandon is
JC: Time, time does heal wounds, doesnt it?
MK: Well, Brandon is a very nice guy. And, you know, I think he thought, he
thought that I was a very nice guy, too. So
JC: Well
MK: And, I
JC: I think you are, too, yea.
MK: We, we both understood what happened, you know. It took me a while
because I was very upset.
GA: Mmm hmm.
MK: But, we both understand that the reason why, you know. We, we both
understood the reason why it happened.
GA: What was that?
MK: Well, I think we just had different, different ideas as to how we
wanted to achieve that end-goal, you know. Ideally, they wanted to build a
news website that was backed off of, you know, cheap content, so to say. To
get, [clears throat]. Excuse me. To get paid to use that, they would then
turn around and sell ads and

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 14 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

14 of 86

turn around and sell ads and


JC: Mmm hmm.
MK: And, I wanted to build smart content, and they wanted to go for easy
content if that makes sense. It would be the di- , it would be like saying
you wanted to try to get traffic for Charlie Rose interviews, and they
wanted to get traffic for cat videos. So [UI]
JC: Yea.
MK: Does that analogy make sense?
JC: Uh, perfectly.
MK: Im trying to explain it to people that might not
JC: Well, weve got a pretty good sense because weve, weve read your, uh,
you know, Producer Matthew pages. So, Ive got a pretty good sense of
professionally where youre coming from. And, uh, how serious you take your
job and, and uh
MK: Well, thats why I think [UI].
JC: -- your background in it.
MK: -- concern me[UI].
JC: Huh?
MK: I said thats why I things like this kind of concern me.
JC: Well, and, and we are
But, it is what it is. We
right thing. So, uh, when
probably November. It was

certainly, we can appreciate it. So, you know.


cant change what happened. So, youre doing the
you left, this would, this would have been 2010,
on

MK: I left, I left middle of October 21, I think of 2010


JC: Ok. Thats right.
MK: 2011.
JC: And, uh
MK: 2010.
GA: 2010
MK: Yea.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 15 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

15 of 86

MK: Yea.
JC: You left, and so, the first thing I noticed is we had this issue with
the email or there was an argument with Brandon about the Facebook and
Twitter accounts. And, then you had an issue, and then the emails started.
And, then Anonymous. Now, I want to make sure I got that sequence right.
When you talked, when you first got involved with Anonymous, you know, what
was, what was going on in your mind at the time? And, what happened exactly
in that fall period? In the turmoil of
MK: I was bored and I felt stuck. And, I have always sort of been
interested in trying to get to like the scene of a story.
JC: Mmm hmm.
MK: Or, to the heart of the story.
JC: Mmm hmm.
MK: And, this was a group that I really didnt know a whole lot about. I
kind of learned about it when the rest of common America heard about it.
JC: Sure.
MK: This attack, uh, this PayPal attack on Visa and Mastercard and PayPal
and. Sorry, this WikiLeaks attack on Visa and Mastercard and PayPal. Um,
let me just start off by saying, I have no knowledge of anybody involved in
WikiLeaks. Uh
JC: [Laughter]
MK: I as a journalist have read their material, you know. Um.
JC: Thats fine.
MK: Im not privy to any material that theyre coming out with in the
future. Im not privy to any material [UI]
JC: Were not here for that, obviously. But, I appreciate you mentioning
that.
MK: Just wanted to get that out. Um, so I popped into the chat room that
was a, the generic operational chat room for whatever that happened to be
at the time.
JC: And, did you use, what, did, how did, howd you pop in? I mean are you
a cha-, are you an IRC guy, or how did

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 16 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

16 of 86

MK: Ive used IRC in the past.


JC: Now, what did ?
MK: Um.
JC: What application did you use for IRC?
MK: Colloquy.
JC: Colloquy?
MK: Does that sound right?
JC: Ok. And, when you first popped in, uh, did you just pop in as a, as a
lurker?
MK: Initially, yea.
JC: And, what was your user ID at that time?
MK: I think that was the AESCRACKED one.
JC: Ok.
MK: It may have been something else, but I think thats what I was using.
JC: How did you come up with AESCRACKED? Was that part of a design to kind
of appeal to the hacker community?
MK: Part of it. Yea. The passwords that, there was, there was a data file
that was released by I think by WikiLeaks by a torrent site that had the
diplomatic cables.
JC: Mmm hmm.
MK: And, it was locked with AES encryption.
JC: Ok.
MK: I didnt know what that was at the time.
JC: Ok.
MK: I know they would.
JC: Yea.
MK: And, so.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 17 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

17 of 86

MK: And, so.


JC: So, it was in part
MK: Kind of like, kind of like what people do when theyre interrogating
another person, you talk at their level.
JC: Uh huh.
MK: Um, we do that as journalists.
JC: Sure.
MK: We talk at the level. Um, and that means, you know, part of that is
just appearance, you know. If you go to a dressy event, you dress
appropriate. If you go to an event thats a little more casual, you dress
casual. You, you look the part for whatever the appropriate scenario might
be. I didnt mean, I, you know, I dont think that, especially the people
that would talk to me, I dont think they ever got the sense that I knew
most of the time what was going on.
JC: So
MK: Would you mind if I turned this fan off?
JC: Of course, go ahead.
[Movement, shuffling]
JC: Oh ok. Well, if you want to put something else on. Thats ok too.
MK: Yea, I think theres a sweat jacket [UI].
JC: Yea.
[Shuffling]
MK: And, theres nothing in here either.
GA: Oh.
MK: If youd like to try.
JC: Yea, we can do that.
MK: Um, so when [UI]at the time [UI] you look the part[UI].
JC: Mmm hmm.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 18 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

18 of 86

JC: Mmm hmm.


MK: If youre going to a county fair, you dress down. If youre going to a
dressy event, you dress up. And, of course, thats irrelevant with what I
was doing because I was doing this from my bedroom in Sacramento. Youre
based in Sacramento, correct?
JC: Yea.
MK: Ok.
JC: So, were you logging at that point trying to save a log of the idea of
kind of doing the research on this?
MK: I think my computer was probably saving something, but I wasnt.
JC: Ok. Not intentionally, youre just researching at this point.
MK: I had, um, you know there are options on Colloquy where it can save a
log.
JC: Yea.
MK: And, I had gone through and turned them all off.
JC: Ok.
MK: Um.
JC: Why did you do that?
MK: Because I knew that if I did have something and I had text logs that
detect, you know, if I were to bring these to somebody. I am just a web
producer that worked at Fox, you know.
JC: Mmm hmm.
MK: Im not, you know, a deputy social media editor for Reuters. Um, what
kind of pull would I have? And, I knew that somebody looking at those text
documents would go, Those have been altered. Uh, Or, those could have
been altered.
JC: Ah, yes.
MK: I should say. Um.
JC: Is that, what, why I am not sure Im following. Thats why you turned
it off or didnt want to do the logging or?
MK: I didnt want to do the logging because I didnt know what was going to

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 19 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

19 of 86

MK: I didnt want to do the logging because I didnt know what was going to
happen.
JC: Ok.
MK: And, I didnt want anything incriminating left on my computer that you
know could be tied to my name or may not have been tied to my name. I felt
like it was at the time it wasnt a completely rational thought, but I
thought that maybe that would give me an extra layer of protection
JC: Ok.
MK: -- between what they were doing and what I was doing at the time. What
they were doing was
JC: Yes.
MK: -- attempting to do some damage.
JC: Yes.
MK: What I was doing was mainly just being an observer.
JC: Right and that wasnt your intention at that, at that point, certainly.
MK: Eventually, later on, when I did start taking logs, it, I didnt do
those with text either. There might be one or two text logs that I took
just because the data was so gratuitous that there would have been no way
to have captured it in a text file.
JC: Sure.
MK: So, which is why, and I, I know you g-, Ive seen these here. You have
screen grabs that
JC: Your screen grabs. So, you were doing screen grabs.
GA: Look like this
JC: Yea[UI]
MK: You, its harder to manipulate
JC: Yea.
MK: -- an image, and when an image is manipulated you can usually run it
through software and detect whether or not it has.
JC: Mmm hmm.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 20 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

20 of 86

JC: Mmm hmm.


MK: As with that, that was obviously manipulated because it was redacted.
JC: Sure.
MK: Um. But, when youre forward with a journalist like Parmy and you say
something has been redacted, you know. Theyre usually a little more
JC: Yes.
MK: There a little more, uh
JC: Its more credible. It has, it has more weight.
MK: Right, exactly.
JC: Yea.
MK: Right. So, initially going in there as, as a lurker, and I think it was
in, I want to say their, their room at the time was like Operation Payback
or something like that.
JC: Ok.
GA: May I ask, before we go, how did you first find out like where to go?
MK: Twitter.
MK: And, this was two years ago before Twitter
JC: Became famous. Yea.
MK: -- is what it is now. I mean it is, it was
JC: It had started, but yea.
MK: It had started to gain a sense because, you know, Obama and Oprah had
joined. [Laughter]
JC: [Laughter]
MK: There were so many people on it. Um. But, it wasnt being used in sort
of the sense that its being used now.
JC: Not as a communication medium, no.
MK: Where you had like 17,000 Tweets between Big Bird last night, you know,
because of the debate. Um. That didnt happen two years ago. Instead you

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 21 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

21 of 86

because of the debate. Um. That didnt happen two years ago. Instead you
had people actually having a discussion, and in monitoring the discussion
that was going on on Twitter. I mean you still have people that are having
discussion. I dont want to sound, um [rumbling noise]. Whats going on?
JC: I dont know. And, uh, theyre, uh, were not here, theyre not going
wreck it, so dont worry. Itll be
GA: If anything, theyre moving a chair back in towards the table or
something along those lines.
JC: If you want to go out and, and see whats going on, I dont have a
problem with it.
MK: No.
JC: So, uh, you, you, you got it from Twitter, you went to Operation
Payback, youre, youre there.
MK: There Twitter account, there was a Twitter account that had been set
up, and they were mentioning things like the Low Orbit Ion Cannon an, which
I still dont really understand what that is or how that operates orI just
know its a thing.
JC: And, so you didnt do any type of denial of service attacks?
MK: No.
JC: Ok.
MK: No.
JC: So, youre clearly, uh, just at this point really just researching it
and trying to understand where theyre coming from, talk to people. Who did
you meet? Do you remember anybody?
MK: I dont remember anybody that I met in the chat room.
JC: Ok.
MK: I think I was trying to make a little bit of a noise and it, nothing
jumped out. Um.
JC: Hard to do in that group.
MK: Well, its hard to do in general because there was so much interest in
it that you had, you know, that, at the time, I dont think there was like
a press room set up.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 22 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

22 of 86

a press room set up.


JC: Yea.
MK: Or, you know, like at one point they did create a press room where
journalists could go in there and talk to them and they would it was sort
of like spin alley
JC: Yea.
MK: -- for the, for Anonymous. And, I remember, um, you know, just throwing
things out there. I, I dont remember what was said, and just not getting
any kind of reaction.
JC: Alright.
MK: And, had I said, you know, Im Matthew from CNN or Im Matthew from
you know this big news organization, they would have latched on I think a
little bit more. But
JC: Maybe.
MK: [UI] Im Matthew the unemployed journalist, you know. Theyre more
interested in how you can help them than they are in
JC: Of course.
MK: Um, you know any kind of story that you would want to do.
JC: I think you have a good insight into who you were talking with there.
MK: I mean, it, its hard to sort of
JC: How much time out of the day were you spending doing this? Is this
pretty much the bulk of your day as youre doing on the computer, still
doing your
MK: When I was
JC: -- keeping busy.
MK: When I was at Fox, I took about two months to sort of not do anything,
you know. I, I really didnt know what to do.
JC: Mmm hmm.
MK: I had never been unemployed before. It was something that I was kind of
bracing for, and people are like, I knew, I had a feeling it was going to

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 23 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

23 of 86

bracing for, and people are like, I knew, I had a feeling it was going to
happen. You know there were changes that were happening at the company.
There were people that were getting let go. A lot of the innovative people
that they brought on initially were being let go. And, um, rightly so, for
reasons that, you know, they should have been let go for, for sending [UI]
emails and for, you know, not meeting certain initiatives. But, I just knew
that there was a cleaning of house that was taking place, and I felt like
at any point Im going to become a victim of this. And, two or three weeks
later it happened.
JC: Sure. So, youre spending a lot of time At some point you did
actually meet some folks though and did get some private message and chats
with folks, uh.
MK: In the chat room?
JC: Well, from the chat room. Or, in the chat room. You were actually
communicating, and
MK: Or on the IRC server well say
JC: Yea.
MK: [UI]. Yea, um, I, I threw something out there in the main chat room,
and I again, forgive, I dont remember what it was.
JC: I understand.
MK: Um, Im sure you have logs of it somewhere.
JC: We do, and I, I dont wanna, uh, prompt your memory. Im trying to get
your recollection, so.
MK: To the extent of you know that I used to work at Fox or, you know, I
have something or other from Fox, or I tried far, to play the Fox, the Fox
part high.
JC: Yea.
MK: And, it was, it was playing to ignorance more than anything because you
I dont want to say too much because my roommate works for Fox.
JC: Right.
MK: But, um.
JC: Its ok

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 24 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

24 of 86

MK: You understand how the public perception of


JC: Of course.
MK: -- Fox News is
JC: Of course.
MK: Um, and so to get their attention that way.
JC: Yea. Did that work?
MK: It worked with Sabu.
JC: Ok.
MK: He reached out to me, and he said what do you have?
JC: Alright, so
MK: And, then
JC: Did you realize at the time who you were talking with?
MK: I didnt realize at the time who I was, I didnt realize who I was
talking with until March 6th.
JC: Oh ok. [Laughter]
MK: So.
JC: Well, I didnt mean specifically. Did you recognize his significance in
the Anonymous community
MK: No.
JC: -- as a talented hacker.
MK: I didnt recognize anybody doing anything at the time.
JC: Ok.
MK: It really wasnt until, um, that night that he invited me into the
InternetFeds room. And, it was, it came from that sort of 15-minute
conversation that I had where.
JC: Well, lets talk about that then because that seems to be kind of a
key, key thing.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 25 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

25 of 86

key, key thing.


MK: I, I told him that I had credentials for their CMS.
JC: Mmm hmm.
MK: And, he asked for them.
JC: Mmm hmm.
MK: And, I gave them to him.
JC: Right.
MK: Um.
JC: Why did you do that?
MK: Because I thought they didnt work.
JC: Ok. Now, that doesnt really square with what you were saying because,
and, and Im going to preface it because its been important that we have
complete candor and we talked about minimization, ok. Because
MK: I understand this, Im trying to remember.
JC: Youre trying to remember.
MK: Right, Im not trying to deceive [UI].
JC: Because my and I and heres my impression. And, and it would
certainly be understandable how angry you would be at Fox News still, you
know, Fox40, particularly. And, and how, uh your desire to essentially fuck
em would be relevant. And, I think its that part of how you said it in
the logs.
MK: That was, I remember saying that later on down the line.
JC: Ok.
MK: Um.
JC: So, in the first instance
MK: I had access to several different sets of credentials for the same
platform.
JC: Because you gave them instructions, you walked them through

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 26 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

26 of 86

JC: Because you gave them instructions, you walked them through
MK: I
JC: -- how to use it. Do you remember that?
MK: I recall offering some guidance.
JC: Ok.
MK: The other thing is that at, at Tribune at that point anyways things had
been changing so much in terms of our CMS product, our, our online product.
We were re-launching our website every six months when I was there. We were
going from CMS to CMS to CMS.
JC: Ok.
MK: And, at the time
JC: Well, I guess, the only reason Im stopping you is because I dont want
you to go down the path of I didnt think that they were going to do
anything with that because I dont think thats true.
MK: No.
JC: And, I, I dont
MK: But, what, what I thought they were going to do with it is I thought
they would find some use for it.
JC: Ok. Yea.
MK: It wasnt, it wasnt
JC: I mean its not like you expect them to take out the entire network and
destroy the company.
MK: From what, from what I can remember, there was a set of credentials
that I gave them.
JC: Mmm hmm.
MK: That didnt work for me. Um. There were other credentials that I gave
them that did work. Um, that I knew worked and expected them to use. At the
time, though, I was
JC: This was in the first instance that were talking about.
MK: From what I can remember on the first instance.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 27 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

27 of 86

MK: From what I can remember on the first instance.


JC: Ok.
MK:
the
how
use

Yea. Because I didnt think that they would work. But, understanding
or maybe the lack of understanding to this matter how hackers work and
the hacking community works. I figured if anybody can figure out how to
these.

JC: Theyre still going to be able to make it efficient. And, that would
build your credibility with the organization, perhaps? Or, is it, or are we
still to screw with Fox or is it a little of both?
MK: I, I [sigh]. I think to be completely honest given the mindset, I think
it was probably a little bit of both.
JC: I understand. I understand. Uh, ok, so were in InternetFeds. Its with
with Sabu. You dont really know how important he is yet.
MK: Im invited into the room that night, the first night that Im on the
chat room. And, I didnt know what I was looking at. There were a lot of
instances where I didnt know what I was looking at. But, my game was to
find out what was going on. Um, my intention quickly shifted from lets
give these hackers who dont get caught and can do some damage something.
JC: Mmm hmm.
MK: It quickly shifted from that to I think I struck upon something here
that people dont know about that maybe people should know about. Um, and,
I couldnt let them see that or know that. Um.
JC: So, was this, is this on the night where they talked about the Gawker
hack and this type of thing. Or, is this, is this a later[UI].
MK: No, I think, I think if I remember correctly the Gawker discussions
came up a few days later.
JC: Yea, ok.
MK: Um, I think what was March 11th that they, not March 11th. It was, um
JC: Like December.
MK: It was like December 11th or December
JC: December 10th or 11th.
MK: You know it was December that they released the Gawker password dump
that Kayla released.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 28 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

28 of 86

that Kayla released.


JC: Right.
MK: The, the dump, and I didnt know that was coming. I didnt have prior
knowledge that that was going to happen. I kind of found out about it when
everybody else did.
JC: Ok.
MK: Um, but what I did know was that, uh, or let me say it this way. What,
what I was able to determine in monitoring the InternetFeds chat room was
that Kayla was taking a lot of credit for what happened with Gawker.
JC: Mmm hmm.
MK: I dont want to get too ahead of myself. Later on down the line I
learned that Kayla had an accomplice with the Gawker hack. And, I think his
name was Garrett. Does that sound familiar?
JC: Yea.
MK: Yea. Um, Garrett told me some things about him or her. I dont entirely
remember what they are, and unfortunately, I didnt save a lot of that
conversation. I saved some of it.
JC: Ok.
MK: Um.
JC; Is that on this hard drive?
MK: It may be.
JC: Ok.
MK: To be honest, I dont remember. It, it
JC: Theres another laptop out there. Is that your previous laptop?
MK: It is, but I dont think I did anything with it, um. I cant recall
doing anything with Anonymous on it. There may be some stuff on there,
though.
JC: Ok.
MK: And, youre welcome to take a look at. Well, youre going to anyway.
[Laughter]

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 29 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

29 of 86

[Laughter]
JC: Well, you know what, the fact that youre, youre willing to help us
find it on there that goes a long way. I mean, that does go a long way more
than you
MK: John, I remember talking to you in April of 2011. And, you called me as
I was moving.
JC: Yea.
MK: I dont know if you knew at the time that I was moving.
JC: Yea.
MK: Um, you called me as I was moving back in with my grandmother. And, I
remember telling you at the time that, you know, as far as it came to what,
you know, at the time, I was working on a story with The Guardian on what
had happened.
JC: Mmm hmm.
MK: [UI]. Um, but I remember telling you that, you know, whatever you
wanted, what- whatever I could give you, that I would. And, that, you know,
that offer never really was rescinded. It was, it just got to a point where
I started working in San Francisco, and there was no time that I had to
dedicate to that.
JC: I understand.
MK: Please dont take personally the fact that your calls went unanswered
and your emails went unanswered. The other thing was I was trying to figure
out how to handle this. And, I never really got to a point where I could,
you know. I, di- , as a new employee at Disney, its kind of weird to go up
to them and say, I think need some legal counseling on how to handle this
story, you know, that Im not working with on, you know, for your
organization on. That its something that came out of something else.
JC: I understand.
MK: Um.
JC: I mean, you know, Im like you. I mean youre professional. I am a
professional, you know. Im just, uh
MK: The difference is I think you know more about what youre doing than I
did at the time about what I was doing.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 30 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

30 of 86

did at the time about what I was doing.


JC: I understand.
MK: Um. And, forgive me as I dont want you to take this the wrong way, you
probably are a little more seasoned to know what youre doing, you know.
And, have had more experience doing what youre doing.
JC: Well, I appreciate your, uh, your, uh
MK: Its not meant to be a compliment.
JC: Comment.
MK: Its just meant to say, its more or less to contrast the fact that I
didnt know what I was doing.
JC: Sure.
MK: [Laughter]
JC: Well, in your realm, you do know what youre doing.
MK: I know
JC: As a, as a
MK: I know more about what Im doing now.
JC: Yea.
MK: I still am not entirely there. I still get
know, for breaking certain rules that you know
Reuters, that theyre not used to, but um, you
to say I get in trouble in terms of like I get

in trouble at work, you


that, there, I think even at
know, its not, I dont want
punished

JC: Ok.
MK: --or I get reprimanded or anything like that.
JC: Yea.
MK: But, its more or less like there are things that, you know, Reuters is
certainly doing things, and I have a certain way doing things and maybe it
doesnt always match, but sometimes
JC: Understandable.
MK: I think they see the incentive in what Im doing. Um, I dont think I
was ever in a position like that with Disney, and so I felt kind of stuck

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 31 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

31 of 86

was ever in a position like that with Disney, and so I felt kind of stuck
between this story that, you know, it was never my intention not to
cooperate with people on.
JC: Well, right now youre doing the right thing, and so.
MK: Right now Im doing the right thing
JC: Its
MK: -- for you guys. [Laughter]
JC: Well, it seems that way
MK: [UI] Its necessarily going to be the right thing for
JC: Heres the issue just to put your mind at ease. And, you know, I really
cant put your mind at ease totally. But, uh, everybody appreciates
honesty. Um, and at some point in time, were going to have to show this to
a prosecutor, and its been my experience that prosecutors are people, too.
And, people appreciate honesty. And, you know, some people makes a mistake,
you know, I mean thats, thats human nature. And, you just said that at,
you know, Reuters you make mistakes. People make mistakes. Its, its, its
something that you can work through. So, and in the scheme of things
MK: I would say, before we, before we continue with the, um, Monsegur case.
JC: Mmm hmm.
MK: Fox had that story before anybody else did, and I dont know what, why
that was. But, given that my roommate works at Fox News.
JC: Uh huh.
MK: And, there are FBI agents out on the couch outside.
JC: Uh huh.
MK: Im very uncomfortable with that mix.
JC: Ok. It has nothing to do with that, your, uh, roommate.
MK: No, I understand.
JC; Or, the Fox News. Yea. Im
MK: As an editorial employee, though, you know [UI].
JC: Yea, well, hes not going to see the warrant. He doesnt have a copy of

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 32 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

32 of 86

JC: Yea, well, hes not going to see the warrant. He doesnt have a copy of
the warrant.
GA: [UI]
MK: We cant predict whats going to happen.
JC: I cant predict anything.
MK: [Laughter] [UI]
JC: So, you know, heres the
MK: I just wanted to make that clear.
JC: Yea, I understand. You know what, were, our job is not to make news.
Ok?
MK: It doesnt mean it doesnt happen though.
JC: I, I agree, but were, were not going to aggravate the circumstance
with, you know, making news So, whatever happens, happens. Um, and I cant
control the future. Im sorry. I just dont know whats going to happen.
MK: No, I understand. I understand, completely. So, Sabu and I are
chatting. Um, I give him a set of credentials that, frankly, I didnt think
were going to work, but I didnt know. Um, per my recollection, he invites
me to the room. Theres about, I think I did a head count at one point, one
of the hackers executed some command line that showed you all of the people
that had access to that room.
JC: Mmm hmm.
MK: And, there were between 33 and 36.
JC: Mmm hmm.
MK: There is an exact count on one of those logs that shows every username
of every person that has access to that room. And, as far as I can remember
those logs still exist.
JC: Yea, they do. When you saw that, did your heart jump a little bit?
MK: I didnt see it right away.
JC: Oh ok.
MK: I mean its not something that they showed me on the first day.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 33 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

33 of 86

MK: I mean its not something that they showed me on the first day.
JC: Ok.
MK: I can tell you the first couple of days that I was in that room I
didnt sleep well that night.
JC: Because?
MK: I had never been subjected to an environment as a journalist or just
even as a human being. I, I just never seen what I saw in that room before.
It took me aback. I wasnt expecting it.
JC: What was it, what was it? Try to characterize it as best you can that
caused the distress for you.
MK: A group of individuals who could do significant damage who felt free
discussing in the presence of people they didnt know, doing significant
damage and not getting caught.
JC: So, these were people that were malicious, and to a certain extent
MK: I think they were malicious without a cause.
JC: And, and dangerous. [Laughter] To the extent that they were kind of
loose cannons?
MK: What concerned me was, you know, I, I think early on I saw, you know,
and I dont remember if it was that night or if it was, you know, over the
course of a couple of days, but it became very clear to me, and this is
something I told, you know, that I told Parmy, and Ive told a couple of
other people. It became very clear to me that these were the people who
were doing the most damage. The kind of things you would hear about on the
news, you know, which unfortunately, I was not contributing to the news
product at the time. Um, I mean I kind of was, and well get to that in a
second. But, for the most part, I wasnt. Um. It, it was, it [sighs]. A few
things stressed me out. That was, um. I mean its ,its still even just
thinking about it, like the gravity of the skill that was in that room and
blatant disregard for any kind of consequence.
JC: Mmm hmm.
MK: Was just, I had never seen anything before like, like that.
JC: Sure.
MK: I mean, it, it was just, it was something that was incredibly a new
thing.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 34 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

34 of 86

thing.
JC: I understand.
MK: And, part of it was, you know, what could these people find out about
me? You know. Im taking a terrific risk on two levels. One, being there,
with them, taking a risk of, of them doing something. And, two, being there
with them, and, you know, having it come across to the people who enforce
the law.
JC: Sure.
MK: Now, I dont want that to be interpreted as, you know, I knew what he
was doing was breaking the law. I really didnt at the time, you know. My
rationale
JC: But, at some point, you did. But, well get to that later, I suppose.
MK: I think, you know, I [sighs]. I didnt do my research. I messed up
there. I didnt look into it as much as I should have.
JC: Mmm hmm. So, it was like the old boiling frog syndrome where you kind
of just
MK: I dont know what that means, but I started investigating a story
before I did.
JC: You didnt know what you were getting [UI].
MK: [UI]
JC: And, it kind of built, and built, and built, and then before you knew
it, you were.
MK: And, I took some action before I did a proper background on it.
JC: Ok.
MK: My mentality was I have the keys to a house that were never taken away,
you know. And, that was one thing that frustrated me about Tribune is that
there were so many things that should have happened when my employment
ended that didnt happen.
JC: Yea.
MK: You know, they didnt ask for my security key back. And for my house
er, Im sorry into my house into my office. And, they didnt ask for, you
know, they shut down my access to my email, my work email, which was one of

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 35 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

35 of 86

know, they shut down my access to my email, my work email, which was one of
the reasons I was upset that day. Um.
JC: But, they didnt take the proper measures for security.
MK: No.
JC: They were very
MK: And, it was one of the things when I was working there I had always
told them they needed to do.
JC: Yea.
MK: You cant let an employee go and have a forward-facing content
management system that anybody can access from the Internet and not take
those credentials away.
JC: Clearly.
MK: I was going in manually as a web producer, and none of my job, my job
is not information technology or anything
JC: Mmm hmm.
MK: --with computers and removing access to these profiles after, aft- long
after people have left , that anybody could get access to, and the company
never seemed concerned about it.
JC: Yea.
MK: Um, and that was frustrating working there.
JC: Sure.
MK: Um, because my concern was always something like, you know, a hacking
attack or, or getting access to information, you know, would compromise the
integrity of the brand, you know. It, it, it would look very bad to our
viewers. It would look very bad to our, our other employees that we looked
like we were incompetent. And, it wasnt because I was incompetent. It
wasnt because my manager was incompetent. It was just because the process,
there really wasnt one, I think, you know, one of a process.
JC: Mmm hmm.
MK: I dont want to ramble on about things that dont matter.
JC: [UI] matters.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 36 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

36 of 86

JC: [UI] matters.


MK: The reason why I felt comfortable with the credentials is because they
never deactivated it.
JC: I understand.
MK: And, they knew that I had it.
JC: Yea.
MK: This is not something that they didnt know I didnt have. They knew I
had it, and they did nothing about it.
JC: Sure.
JC: Careless, lax on their part, but almost, did you count it as then its
almost as if its your property since they let you have it. Or, not quite
sure how you really felt about it.
MK: Its not
JC: Its hard to put yourself back in the mindset of that time.
MK: It wasnt my property. It was, they were keys that I had access to.
JC: Right.
MK: Thats how I looked at it. I still had access toIt would be as if a
server was a building.
JC: Mmm hmm.
MK: Its a physical object.
JC: Sure.
MK: You know, and I had a key to a physical building. Lets say I was the
night manager at a retail store.
JC: Mmm hmm.
MK: And, they gave me the keys to the building to lock up at night.
JC: Ok.
MK: When you leave, youre supposed to take those keys back. You dont want
that employee to still have access to the keys.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 37 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

37 of 86

that employee to still have access to the keys.


JC: That seems logical.
MK: It makes sense to us.
JC: Yea.
MK: We get it. We think that way. It doesnt make sense to them.
JC: They didnt do it.
MK: They dont think that way. And, for two and a half years, I tried to
get them to think that way, and say, look, something could happen, you
know, and you would really have no recourse for it. You know, you could
say, you know, the servers are our property, none of the credentials were
misappropriated as I saw in the complaint that was filed back in March.
JC: Mmm hmm.
MK: Well, actually, it was filed in August.
JC: Yea.
MK: [UI]available in March. Ive read all of that. Ive had access to PACER
[Laughter]. Um, you know, you could say all of that, but at the end of the
day, you have to answer for the fact that you didnt take those keys away.
Was it misappropriated? It was misappropriated to the extent that I gave it
to them.
JC: Right.
MK: You know. But, was it really? The company gave me access to a product
and didnt take it away.
JC: I understand.
MK: You know. And, it wasnt even the fact that they didnt take some of it
away. They didnt take anything away.
JC: Alright. Clear, well, and its been, its been over a month though, at
least. Because October, November, here you are going
MK: It was at least a month and a half to two months. And
JC: I can hear some noise out Im going to step outside because its
distracting, and uh, uh, talk to the [UI]. Ill be right back. [UI].

JC: [UI]. Hes talking freely, and uh. Im going to come out with the hard

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 38 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

38 of 86

JC: [UI]. Hes talking freely, and uh. Im going to come out with the hard
drive.
UM4: Ok.
JC: As soon as I can get it. But, uh, we dont need to do any searching
UM4: We havent searched anything, so.
JC: Ok.
UM4: There are other computers, laptops, iPads, um.
JC: [UI]
UM4: The roommates say they dont, he doesnt have access to them.
JC: Leave them.
UM4: Alright.
JC: Yea, leave those guys go. Uh, so this guy has been fully cooperative.
So, Im going to get some pictures. Then hes got this laptop which I think
we can take his old laptop. Weve got a new laptop which we may take. And,
then we got this hard drive. Were definitely going to take. Ok? And, uh,
[UI].
UM5: [UI] bring that stuff out
JC: Yea, Im trying to, but uh, I dont want to break the flow.
UM5: Maybe well cut some people loose.
JC: Thats totally acceptable. I would say, yea.
UM5: [UI]
JC: [UI] completely cooperative in there.
UM5: [UI]
JC: Yea, Im just, uh, I can hear the noise out here, and theres a lot of
guys out there. And, he has a roommate.
UM5: [UI]
JC: And, I was thinking that, uh.
MK: [UI] do anything about our neighbors or anything like that?

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 39 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

39 of 86

MK: [UI] do anything about our neighbors or anything like that?


JC: No, no.
MK: Theyre welcome, theyre all welcome to come in.
JC: Yea.
GA: [UI]
JC: Yea, I just didnt, uh, you know, want to cause any problems with your
roommates. And, then if they wanted [UI].
MK: [UI]
JC: Alright. [UI] Im guessing
MK: [UI]
JC: Sorry about that.
GA: So, you were saying then that you gave one set of credentials
MK: I gave one set of credentials to Sabu.
JC: Mmm hmm.
MK: Um, I didnt know what he was going to use them for, but at the time I
really wasnt concerned about it. I figured, I didnt even know if theyd
work, to be frank. Um, I did have access to a set of credentials that I did
know worked. I dont recall giving that to them.
JC: Mmm hmm.
MK: I may have. I dont really remember. Um, but
JC: Well, well refresh your memory on that I suppose cause weve got those
logs, and we can show you and you can.
MK: Sure. Um.
GA: And, at some point actually, you, once you gave them credentials you
saw that they were using them effectively, so you knew they worked at that
point, right?
MK: I did not monitor what they were doing with it. They were telling me
that there were certain things, you know, that, that they did eventually
get access to the content management system. As far as I know, they didnt

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 40 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

40 of 86

get access to the content management system. As far as I know, they didnt
have access to anything internal. And, by internal, I mean, something that
is not forward-facing, something that you would not otherwise be able to
access by the Internet.
JC: Mmm hmm.
MK: Our content management system you could [UI]. Tribunes content
management system you could access through the Internet. Um, again, thats
one of those things I always thought was a flaw on their end, but
regardless. There were actually two content management systems. They were
identical. Um, and they both did the same thing. They both fed into the
same server. The only difference was that one was internal. One was
external. But, they were the exact same thing.
JC: Mmm hmm.
MK: It was just how you got access
JC: Sure.
MK: -- to them was different. Um, but the credentials worked across the
board. The login pages looked identical. Im sure youve seen all of this.
JC: Mmm hmm.
MK: So, um, you know, they were, they, they would tell me that they saw
certain things, that yea, clicked to me, and they told me that they saw
certain things that I didnt even know were in there. Um, it became clear
to me after a while that Tribune must have at some point known that this
username was out in the wild. They were telling me things that even working
at Tribune I had never seen before, but somebody at Tribune had to have
gone on their end and unlocked a lot of doors. Um, it was almost as if, you
know, and please dont take this out of context because I dont know that
this is true, but based on my observations, it was almost like they were
given super user access.
JC: And, that surprised ya.
MK: Well, I had never had it before. [Laughter] So
JC: Yea. So, you gave them the account, and they were, and you were
surprised how effective they were in terms of amplifying it right?
MK: I dont think that anybody who looked at it from the outside wouldnt
have been able to figure out how to turn that on. In my opinion, you know,
again, you guys probably know more than I do. In my opinion, it came across
to me as if somebody at Tribune had turned something on.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 41 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

41 of 86

again, you guys probably know more than I do. In my opinion, it came across
to me as if somebody at Tribune had turned something on.
JC: Ok.
MK: They, they may have done it not knowing the circumstances
JC: Right.
MK: Behind who had access to that account. They may have done it
JC: but somehow this account that you gave them became more powerful than
you thought it was going to be.
MK: Yea.
JC: And, thats what youre telling me.
MK: Yea.
JC: Ok. But, is it that really surprising when youre dealing with these
uber hackers that youre dealing with?
MK: If were going back to the mindset that I had at the time, it did.
JC: Ok.
MK: Um, it really did because you know I, I, I felt uneasy about what I was
seeing, and in the back of my mind I kind of knew.
JC: Kind of an oops moment.
MK: No, no Well, heres, no, what Im trying to get at is You know, the
feeling that I had when I first got into the room of being uneasy and not
being able to sleep the first couple of nights that was prefaced on the
fact that there was appeared to be a blatant disregard for any kind of
civil-civility or any kind of law.
JC: Mmm hmm.
MK: It just seemed to be doing things because they can do things. And, but,
I, I really didnt have a good grasp and still, to this day, dont on what
is possible on their end and what is not. You know, what they had and what
they can do and what they cant do. I, you know, just based on my knowledge
of Tribune and how the Tribune Companys CMS worked, if youre introduced
to a new environment, kind of like I was, you dont inherently know what
youre looking at.
JC: Sure.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 42 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

42 of 86

JC: Sure.
MK: You feel overwhelmed by it, in fact. If its, if you have an abundance
of stuff. And
JC: But, you talked them through it a little bit, I mean in terms of how to

MK: Well, kind of


JC: Yea, what you knew.
MK: Very limited things that I knew.
JC: How to navigate.
MK: I, I know how to publish a story. They, they did publish an LA Times st
ory. Or, they, let me clarify. Uh, they either published a new story or
they edited an existing story.
JC: Now, are you referring to that Chippy1337 story?
MK: Yes, I think they edited an existing story.
JC: How did you feel when you saw that?
MK: Um.
JC: I mean, you knew there was a correlation, Im, Im sure. How did you
feel?
MK: I didnt know what had happened until somebody pointed it out. And, by
somebody, I mean somebody in the room.
JC: InternetFeds, yea.
MK: Um, and I really dont remember what my mindset was. It was
JC: Did you go look at the story?
MK: I did look at the story
JC: Ok.
MK: --and I saved a screenshot of the story.
JC: Alright.
MK: And, I dont think I still have access to that. But, I do know its out

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 43 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

43 of 86

MK: And, I dont think I still have access to that. But, I do know its out
there, um. And, I dont know where it is. But, I, I do know it exists
somewhere. I have gone back and looked at it and seen it. Uh, its still
cached on a Google server Im sure.
JC: So, you dont really remember how you thought about it, I guess Im
trying to get a sense of, uh
MK: How I found it was somebody in the chat room linked to it.
JC: Linked to it. And, then, but you know, when, but ultimately you were
responsible for that because thats what Im trying to understand as far as
like, Oo, I wish I hadnt done that, or was there a
MK: I didnt
JC: Not that serious feeling? Or, what were you feeling?
MK: I didnt go into the server and change anything.
JC: So, you felt removed from that?
MK: To be completely honest, I felt like I incited it.
JC: Ok.
MK: But, as far as what they did in the server, or when they had access to
the CMS, you know, I dont recall ever suggesting that they do certain
things.
JC: How do you feel about that now?
MK: Um.
JC: Looking back.
MK: I feel like now it had minimal impact.
JC: Ok.
MK: And, that was something that wasnt really addressed by Tribune. Um,
it, it had very low impact.
JC: Alright.
MK: And, to be honest, I was surprised because this is a group that has
always had high impact. But, what apparently happened was there was one
user in the room. I dont remember what their username was. Its probably

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 44 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

44 of 86

user in the room. I dont remember what their username was. Its probably
in the logs, and when I see it, Ill, Ill remember it. There was one
person in the room who took it upon themselves to sort of be a little bit
of individual shenanigans. And, um, it really upset Sabu because Sabu said
he had big plans for those accounts, um, and by those accounts, what I mean
is they eventually, I fully believe, based on the conversations that weve
had within in the room that I wasnt always a part of, but did observe, I
believe they had access to other accounts.
JC: On the CMS?
MK: I dont know how they had access to them.
JC: Mmm hmm.
MK: I really dont know what that process is like. Um, I may have at the
time, but I dont remember what it was like. I, I genuinely dont remember
how to do it now. Um, but, and I wouldnt see why they wouldnt.
JC: Sure.
MK: They had a month to sort of
JC: Work on it.
MK: You know, poke around there. I dont think it was a very high priority
for them. Um, frankly, I think that they, I dont believe Sabu when said
they had big plans for the site. Frankly, I think that they looked at it
and they thought this is really not worth our time. And, the reason why
they let me sort of stay in the room for as long as they did is because
they didnt think that me being involved was going to, uh, let me rephrase
that. They didnt think of me observing them was going to, uh, do any kind
of, have any kind of significant impact on what they were doing. If
anything, I was kind of, if you think of it in terms of a schoolyard group
kind of thing, I was the kid who didnt really know anything, and they
could kind of throw back to it as like, you know
JC: Sure.
MK: This kid didnt know anything but we kind of like being around him. Um,
and that was almost deliberate after a while, you know, uh, I, I did play
to that to find out, you know, sort of how they do certain things. And, I
can already tell you, you know far more about how they do certain things
than I did. I mean that there were things they were trying to explain to me
which just frankly didnt make sense.
JC: Mmm hmm.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 45 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

45 of 86

JC: Mmm hmm.


MK: I dont have a computer background as far as I publish content to the
computer to the Internet, you know. I dont really know how my online
banking works
JC: Right.
MK: -- for example, you know [Laughter]. Like, its just, I dont
understand the, the nuts and bolts of how things get from
JC: Besides giving them the credentials to the CMS, um, did you do anything
else to the system? Maybe help them do something that would be considered
illegal?
MK: As far as I remember, I didnt.
JC: Ok.
MK: Did you have something in mind?
JC: Well, I dont want to prompt ya. Yea, so.
MK: Please, if, you know, I, I want to be completely honest, too.
JC: I know. I
MK: So, you know, what I dont
JC: And, its like I said before, Im com Im being honest with you.
Theres two issues I want to cover. One is this issue with giving em the
credentials to the CMS. And, youve been candid about that. Youve admitted
your role in that, and youve been forthcoming. So, thats all good. The
other issue I wanted to talk about was, you know, the, kind of the email
stuff that went on with Fox afterwards. Now, Im not sure as far as the
legalities of that, but I mean, it did cause some heartache with them, and

MK: The emails was, was to be antagonistic, you know. It was to be it


was, it was basically to show their viewers that this is a company that,
you know, I dont know what that was about just now. But, um, I did see a I
did see it, Im very observant. Um
JC: What was that?
MK: The head nod between the two of you. I dont know what that was about.
JC: Oh, Im, Im just looking over to see if Gabe [UI}. [Laughter]

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 46 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

46 of 86

JC: Oh, Im, Im just looking over to see if Gabe [UI}. [Laughter]
MK: Oh, no. Oh, thats fine. Um, forgive me then.
JC: Oh no. You, youre reading things in there that arent there. But, its
ok.
MK: Im reading into a lot of things right now. This is, because Im now
going to have to you know
JC: Process all of it.
MK: Right, you know, uh, and figure out where things go from here. Um, as
far as, the emails it was, I dont think that. It was more or less
hooliganism.
JC: Hooliganism. But, at the same time, you know, I was kind of struck by
that, and I, I, and that makes sense. Uh, so we had the emails you took.
Uh, you did actually contact some folks, you know, and, and screwed things
up there for em. I mean, what was, its just hooliganism? Were you trying
to who, who were you angry at? Was it Brandon Mercer? Was it the company,
in general? Cause
MK: It was, it was
JC: -- because the employees were somewhat terrified, as well, as you would
understand. Or, did you not, were you unaware of this?
MK: There was probably a lot of things that I wasnt aware of that,
frankly, I dont care to know.
JC: Ok. I got to tell ya, I mean a guy like Joseph Huerta. I mean did you
know him?
MK: I did.
JC: What, what were you thinking? Did you want to hurt him?
MK: Um.
JC: Were you angry with him?
MK: There were things that happened during the course of my employment
there, and even afterwards, that you know, he was sort of responsible for.
JC: Uh huh.
MK: And, I genuinely believe that there was an email that came back to me

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 47 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

47 of 86

MK: And, I genuinely believe that there was an email that came back to me
about one of my half brothers [UI] found me on the Internet that frankly I
felt he was responsible for.
JC: Ok.
MK: And, still do.
JC: Alright. So
MK: To the extent of that my observation certain [UI] he was using [UI].
Should say certain [UI} he was using.
JC: Right.
MK: Um, [UI] fit.
JC: And, you went through proxy servers for all of that.
MK: Correct.
JC: Now, you said you werent a hacker, per se, but you did understand how
to get a proxy server and how to use it.
MK: I dont understand what proxy server is, like, I,I dont understand the
intricate details of a
JC: But, so when you went to Yahoo! For example
MK: [UI] Let me say this. Its not, I, I dont even know if what I was
using was a proxy server. What I was using was a virtual private connection

JC: Ok.
MK: Virtual private network.
JC: And, how did you set that up?
MK: I paid a company. They gave me software and had access.
JC: What company did you pay?
MK: Its called Overplay.
JC: Overplay.
MK: Yes.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 48 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

48 of 86

MK: Yes.
JC: And, how did you learn about Overplay?
MK: I Googled, um, how to watch British television from the United States?
And, Google, uh, excuse me, Overplay is an, is a service that bills itself
an expatriate service where you can if you was in one country, you can
watch live television or on-demand television from another country. Um, it
dawned on me, um, and forgive me, I dont remember when I signed up for
this service, initially.
JC: Alright.
MK: It dawned on me, though, that the service gave me a different IP
address.
JC: And, did you check these IP addresses to see where they were coming
from?
MK: I dont remember if I did, but I, but they were foreign to me.
JC: Ok.
MK: Um, what I can tell you is that, um, yes, I did, I did check them.
JC: Ok.
MK: In all [UI]. Forgive me for the brain lapse. I ran them through like a
who-is-my-IP-service
JC: Uh huh.
MK: -- to find out if they were coming from the country they said they were
coming from.
JC: Right.
MK: And, what, and how, you know, how they were registered and things like
that. And, this was before my involvement, my observation with Anonymous.
This was, I think I was still working at Fox when I signed up for this
service.
JC: Ok.
MK: And, it was [clears throat]. I was blown away by the fact that you
could do this. I had never known this existed, and frankly, had I known
this existed, I would signed up for it a long time ago.
JC: [Laughter]

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 49 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

49 of 86

JC: [Laughter]
MK: You know, for a while, I, I wasnt a customer of theirs after a while.
JC: Right.
MK: And, I recently signed up again when the Olympics happened. Um, because
we needed access to, you know, goo video. And, NBC is [UI]. Um, [clears
throat]. Its totally irrelevant[UI], you asked me.
JC: I, Im getting at you, uh, when youre sending these emails, you knew
you were anonymous and not trackable by Fox News.
MK: I didnt know if I was not trackable. It never occurred to me to
whether or not [clears throat] I was completely, you know, un-trackable.
But, I, I was at least aware that there was an extra layer between me and
anybody else.
JC: Yea. And, at the time, your, its just harassment. What did you hope to
accomplish by doing it?
MK: It wasnt even really harassment. My well
JC: Hooliganism or just defacement or what was
MK: Looking back on it now, thats what I would classify it as. At the
time, though, that wasnt my intent. What my intent was, is, as an angry
former employee was to say to their viewers, Look, this is whats going
on.
JC: Mmm hmm.
MK: And, I remember one of the emails that I sent was about the, its like
an iPad contest, or some kind of contest that was going on that was my
idea, by the way, which Im glad they did. Um, but there was a contest that
was going on, and the contests there are not ethically, um, and maybe not
even legally, um, whats the word? Played, I guess.
JC: Sure.
MK: I mean, for lack of a better word, executed, and [UI]. The-there are
certain practices that they do that Im not sure if theyre illegal or not,
but was a concern to me when I worked there. And, I aired those concerns.
And, I said, Listen, if somebody, you know, gets this out there, this
could be really bad. One of them was, you know, we did a contest called

the Cash Grab. We were one of four TV stations to do this Cash Grab

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 50 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

50 of 86

the Cash Grab. We were one of four TV stations to do this Cash Grab
contest where we had like $100,000 and a $1,000,000, in singles and other
denominations that we gave a contestant the ability [UI].
JC: Mmm hmm.
MK: And, they got to keep whatever was left. Turns out, a local politician
was tapped to do that. He won. Um. [Laughter]
JC: [Laughter] What a surprise!
MK: [UI] mean
JC: Yea, I can [UI].
MK: He won fairly, you know. There was no
JC: No, I, I
MK: There was no deception going on there, but what concerned me was that
it became evident to me that management and other employees werent aware
of the fact that we were on a delay on other broadcast services. And, the
reason why I bring that up is because one of the ways that you entered into
this contest was a number flashed on the screen at a certain time.
JC: Uh huh.
MK: And, you call that number, and if you were number x, you know, you
were thrown into this lottery system. And, one person was picked from the
lottery system and thats who got the opportunity to partake in the
contest. None of us thought this contest was a good idea. The employees
were, you know, that participated in it, um, but one of the concerns that I
mentioned was that were on a delay on certain services. You know, when we
air the number on Comcast, on our in-house cable system, uh, or on Comcast,
um, its not going out at the same time as people that are on Dish Network
or DIRECTV.
JC: Mmm hmm.
MK: And, theyre getting it 10, 12, l 15 seconds later. And, theyre not
getting the opportunity to participate, and its simply because the
producers want to get it over with
JC: Yea.
MK: -- as soon as possible. And, had that gotten out you know, it would
have caused a shit storm.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 51 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

51 of 86

JC: Yea.
MK: And, rightly so. I mean that was an extremely insensitive and uncaring
thing to do to viewers. I bring that up because [UI].
JC: Yea. Now, I see your point. Yea.
MK: That was one of the catalysts behind what was going on. Um, with the
emails is that, you know, to sort of say, Look, theres all these gimmicky
things that the station is doing to get you to tune in, and you guys are
kind of suckering yourself into it because youre taking it in, but youre
not being given a fair opportunity to
JC: So, its, its kind of a, in some sense it sounds to me like you were,
you were upset and angry. And, in some sense, its a righteous anger about
some of their actions. Um.
MK: So, I sent emails, you know I was able to obtain emails from a separate
content management system that, again, I still had access to. Um, I dont
ever recall giving that to anybody involved with the Anonymous group.
JC: I think you offered to sell it to them, as I recall, in one of your,
uh, things. Anybody, I think, you told them that you had a list through,
anybody want to buy a list of Fox News?
MK: Yea, my, my, my honest intention was not to sell it to them. It was to
provoke reaction.
JC: Provoke reaction.
MK: Yea. Um, so, right away, that would not have happened.
JC: So, you never gave them the email list other than, and the only way you
used it was
MK: To be completely honest with you, I dont remember if I ever did give
them the email list.
JC: Ok.
MK: I really dont remember.
JC: Alright.
MK: I dont, I have no reason to believe they ever used it for anything,
though.
JC: Ok.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 52 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

52 of 86

JC: Ok.
MK: Um, but, I certainly did have a list. I dont remember, I mean, I
really dont recall if I have that list now.
JC: At, at one point Brandon Mercer, as I understand it, called you up and
confronted you with, uh, these emails, and you said, No, I have nothing to
do with it. Were you still angry with them? What, what was going on then?
MK: I was, um, I was angry with them for a long time.
JC: How do you feel now? Time heals all wounds?
MK: Um. [Pause]. There are days when I look back on it, and I think, you
know, I dont think angry is the right word to use because I wasnt really
angry. I would have been angry if I hadnt prepared for it and didnt know
it was coming and didnt sort of see the warning signs. I was hurt by what
happened. And, thats a word that, you know, in talking with other people
about what had happened with my involvement with Tribune when I was being
interviewed by ABC and when I was being interviewed by Reuters, you know,
the issue did come up, why did you leave? You know, why were let go? And,
you know, how do you feel about it? And, the word that Ive always used,
and I think is most appropriate, was that I felt hurt.
JC: Do you have any regrets, or rem-um, were you sorry now in retrospect
about the whole, you know, doing this kind of hooliganism, and the
MK: It shouldnt have happened. So, yes.
JC: Um
MK: There is some
JC: Because it, it seems like its
MK: Theres some incredible
JC: Theres little payoff for it. It just seems so pointless.
MK: Theres, theres, theres so many incredibly good people that work
there.
JC: Yea.
MK: That still work there. Brandon is one those, I consider Brandon to be
somebody that, you know, he gave me my first opportunity to work in
television, you know, to, to work in news. I wouldnt be here, you know.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 53 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

53 of 86

JC: I read some of those emails. He was, that guy was pretty upset. I mean
he didnt know which way was up with those emails.
MK: Brandon?
JC: Brandon.
[Pause]
JC: If you were given a chance, would you apologize to Brandon about what
you did?
MK: Yea.
JC: Ok.
MK; And, it would be sincere.
JC: I believe it.
MK: The, the hesitation was on two levels. You know, to do anything, and
one was would I be indicting myself. Seems irrelevant at this point. And,
the second is just embarrassment. Of, of, you know, trying to be the, of
wanting, I should say, wanting to be the bigger person and not having been.
JC: Well, heres what I will tell you now and answer to that. First of all,
you know, with regard to, uh, the past or the facts, you cant change what
you did.
MK: Right.
JC: And, you cant change the facts.
MK: I agree, yea.
JC: And, so going forward from where you are sitting right here today
MK: This is one of the reasons why Im talking to you as opposed to saying,
you know, I want a lawyer, or I want to talk to, you know, counsel at
Tribune, or, again Im sorry, Reuters or anything like that is because, you
know, I did it.
JC: I know. And, but more than that the thing, and this brings me to my
second point, is its one thing to know you did it, and theres another
thing to be, uh, to have sufficient character and sufficient humanity
really to just face the truth and do the right thing for the people that
were affected by what you did in the past minor, major, in whatever way.
But, its, its a character issue, and I, and what youre showing me now is

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 54 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

54 of 86

But, its, its a character issue, and I, and what youre showing me now is
that you have that character. And, I, I admire that, I think thats, uh, I
think thats a good thing, so.
MK: There are consequences for everything people do, and for what I do, for
what other people have done, you know
JC: Mmm hmm.
MK: -- there are, there were consequences for what happened at Fox. And, my
concern was, you know, in being hurt was that there were not ever going to
be any consequences.
JC: Yea.
MK: And, now, there were.
JC: Yea.
MK: And, by now Im think-Im going to back to my state of mind
JC: Mmm hmm.
MK: -- in December. Now, there were. And, um, it didnt change anything.
JC: Yea.
MK: In terms of, you know, it didnt make me feel better.
JC: I know. Funny how that works, isnt it?
Mk: Of course beforehand I would have had no idea if, if it did or not.
JC: Yea.
MK: But, it didnt make me feel any better, you know, it, it frankly, one
of the reasons why I asked Brandon out to coffee was because I didnt, like
I said, initially, I didnt want there to be any animosity. I just wanted
there to be, you know, I just wanted us to be able to work together again.
JC: Yea.
MK: Whether or not we have friendship or a working business relationship, I
just wanted us to be able to work together again. And, for some of the
people on the staff, we have been working together. You know, Ive
coordinated with their web producer, the person that now has my job, [UI]
two days ago.
JC: Well, I havent phoned Brandon in a while, but I did get to know him

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 55 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

55 of 86

JC: Well, I havent phoned Brandon in a while, but I did get to know him
briefly. I talked with him a few times, and he, uh, strikes me as a, uh,
the kind of guy that is not going to hold that against you in a significant
way if, if you were to talk to him and, and essentially apologize.
MK: Brandon is, as a person, he is one of the most generous people youll,
youll meet. Hes one of the nicest people youll meet. Hes one of the
smartest people, frankly.
JC: Mmm hmm.
MK: You know, as a manager, hes lousy. You know, thats
JC: Not surprising how that combination MK: And, its not because he was my boss, you know, and everybody has sort
of animosity towards their boss, but, and, and, you know, America workplace
America. I love the boss that I work with now.
JC: Yea.
MK: Um, but, as a manager, he just wasnt effective. A lot of people, a lot
of good people were being let go that didnt need to be let go because of a
direction that doesnt work. And, still to a certain extent doesnt work.
JC: Yea.
MK: You know, I mean I work in media. We look at each other and, and judge.
We shouldnt, but we do.
JC: Sure.
MK: And, there are still a lot of people that, you know, there are people,
frankly, that I went to a party in December, that December and the
hacking, was hacking, it wasnt hacking. The hacking was, was brought up at
this party, and they were asking me, Who is Fox Mulder? You know,
Whoare you Fox Mulder? and of course I was denying it. And, the
sentiment there was, you know, you say they were terrified. Im surprised
to hear that because when I was at this party, the reaction that I was
getting was its about time. You know, somebody did something.
JC: Yea.
MK: And
JC: Ill, uh, Ill characterize it this way. When I was called in after
MK: I believe that Brandon was terrified. [Laughter]

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 56 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

56 of 86

MK: I believe that Brandon was terrified. [Laughter]


JC: Ah, I dont know how terrified Brandon was. I talked to some of the
girls there. They were genuinely upset, and I think their fear was
MK: They were upset because
JC: -- they didnt know who was behind this. And, there have been some
other issues at the office because employee morale may not have been so
great. They didnt know what was going on, and people have a fear of the
unknown.
MK: I didnt
JC: And, there was greatly sense of the unknown.
MK: I didnt help contribute to the fact that the employment or the morale
was not the best.
JC: Mmm hmm.
MK: Because I walked out of sales meetings, and I threw fits in the
newsroom, most of which Brandon were involved in. Um, as a manager, I
think, you know, looking, not me as a manager, but looking at Brandon as a
manager, there were certain things that, you know, were just were aired out
in the public that I think he wanted, he felt were positive because he
wanted to build a democratic work environment. But, in reality, shouldnt
have happened.
JC: Right.
MK: Because you just cant manage people that way.
JC: I understand.
MK: You cant publically manage people that way. The argument that he and I
had that ultimately left, you know, I decided that I wanted to leave after
we had that argument on Thursday. I was officially terminated on Monday. On
my paperwork it said I was laid off, which I think that they did that so
that I could collect the unemployment which is [Laughter]
JC: Or, maybe not to hurt you in your future endeavors.
MK: The, the
JC: Its hard to say.
MK: The, the people that ABC spoke with when I was being interviewed there

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 57 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

57 of 86

MK: The, the people that ABC spoke with when I was being interviewed there
told who would eventually become my manager that I was fired.
JC: Hmm.
MK: And, I had to un-dig that hole, and say, Actually, heres what
happened. And, I appreciate that they gave me that opportunity, but
JC: Hmm.
MK: The I genuinely believe some people were upset. I dont think that
they were, you know, you spoke with them. So, you know.
JC: Yea, I speak to everybody.
MK: Im, Im just coming across this as based on my observation and, and
how I used to work with them, and I still keep in touch with them. They
never came to me and, and, you know, I, I think I know some of the people
that you spoke with.
JC: Well, I mean Im thinking of, uh, and I cant put names to faces, but
Im thinking things of probably like more like secretaries. People that
didnt, that had only been on the periphery, you know, of, uh, what was
going on and knew that this sort of stuff was happening, knew that there
was an issue, felt this un-described kind of threat to the organization and
didnt know where it was coming from.
MK: There were some people that I think genuinely, you know, they love the
brand, they love the company, you can do whatever you want to them and they
are just happy to have a job.
JC: Yea.
MK: You know, and, I understand that. I completely understand that. And, if
theres any sort of fear of, of being terrified its because, you know,
theyre, theyre more afraid of, of the fact
JC: The unknown.
MK: [UI] shake up than they are of what was happening. And, Im just
speaking based on, please dont let me characterize anybody, but Im just
speaking completely
JC: How you perce
MK: as a former employer there
JC: I understand.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 58 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

58 of 86

JC: I understand.
MK: --and understanding how things worked there.
JC: Ok.
MK: Thats, I dont think this is, thats relevant to what were talking
about but, um. So, the reason, the emails, you know, I had access to
emails, to email, to be more specific, I had access to email addresses of
people who may or may not have entered this contest. And, it was based on
credentials that I was given and never were taken away from me.
JC: Ok.
GA: Did the Cash Grab contest [UI] you spoke about before?
MK: No, this contest was [UI] you know in coming up with this contest I
believe was the iPad people [UI].
JC: Yea, yea the IPad, the Christmas, uh
MK: -- it happened in December. Again, it was my idea.
JC: Yea.
MK: [UI]
JC: Uh, are you still in contact with anybody, uh, in, um, Anonymous
hacking realm?
MK: I reached out to Jack Davies, uh, on the advice of Parmy to try and get
him to do a story with, um, my boss who is, uh, a hes, hes a social media
editor at Reuters and he also does technology assignments.
JC: Mmm hmm.
MK: And, I wanted to reach out to him to try to, um, uh, do a story. You
know, he had written up a piece in the Guardian
JC: Yea.
MK: -- that Im sure youve read. Uh, you know, saying, Life is great
without the Internet. Uh, which I would really consider for two weeks.
Its not that bad. [Laughter] You get used to it. Um, I wanted to sort of
talk to him and have my boss talk with him and try and get perspective, you
know, like have a cell phone number that Parmy gave me that I texted and I
said, you know, my name is Matthew, I work for Reuters. Uh, I dont know,
you know, frankly, based on my text that I sent him whether or not he would

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 59 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

59 of 86

you know, frankly, based on my text that I sent him whether or not he would
have known who I was.
JC: Yea.
MK: Uh, but I can tell you that I didnt hear anything from him, and I
emailed Parmy, and I said, You know I didnt hear anything from Jack.
Whats going on? And, he, she said, Well, he didnt get your text. And,
I figured, well, its an international number maybe thats why. Um, but,
uh, as far as keeping in touch with anybody with Anonymous
JC: Yea.
MK: Uh, not since, my last involvement with, I want to be very clear when I
say involvement, its more or less observant.
JC: Mmm hmm.
MK: I didnt hack into anything, committed no criminal offense, you know,
as far as I am aware of. Um, I think it was March. May have been January of
2011 was the last time that I was given access to the InternetFeds room.
From that point on, I really didnt go into the chat room, you know. I
would go in every now and then to just kind of see what was going on.
JC: When, when was this? March of this year?
MK: I believe it was no. Uh, January of 2011
JC: Ok.
MK: -- was the last time I was given access to the room.
JC: Alright.
MK: I was in there for about a month. Uh, they shut the room down because
things were being leaked out. By me. You guys [UI]
JC: Yea.
MK: [UI]
JC: Oh yea.
MK: Um, and by that point, the damage that I had done in giving them those
credentials was already
JC: Right.
MK: Done.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 60 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

60 of 86

MK: Done.
JC: And, just to clarify, when you say no criminal intent, I mean, I, I
hope Ive been clear, but, uh, it says at the end of the warrant, it says,
uh, it is, uh, with regard to, you know, giving passwords, thats actually
technically, technically illegal. I mean its, uh
MK: I didnt know that at the time. [Laughter].
JC: And
MK: And, Ive since found out, um, you know, Ive since done more
background research on this.
JC: Ok.
MK: And, um, I dont want to incriminate myself upon, you know, by saying,
I did or did not.
JC: Well, youre not making it worse than it already is or, or less. I mean
it is what it is.
MK: I just want to be honest with you and tell you what happened.
JC: I understand.
MK: You know, as far as any kind of charges or indictment or admission or I
think that will come later in some of the guilt or not. Um, I just want to
tell you what happened.
JC: I understand, and I appreciate that.
MK: And, [UI].
JC: Yea, I mean going with, well, well go back I mean, but I do want to
be clear. I dont want to misinform you because, uh
MK: I understand what you guys have to do.
JC: You know, I mean theres particularly giving passwords, theres the
trafficking passwords. Even taking the email list from Fox News after they
terminated you. You know, thats technically a computer intrusion, and
youre not supposed to do that, and you know, you knew you werent supposed
to do it.
MK: No, what I, I didnt, I didnt know that I wasnt supposed to do it.
What I would say is that my mindset was I had access to things that they
should have taken away.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 61 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

61 of 86

should have taken away.


JC: I understand.
MK: But, they didnt. So in my mind
JC: I understand. Yea, its not, uh, well, I mean I, I
MK: I understand the perception.
JC: Yea.
MK: Dont get me wrong.
JC: No, I
MK: I understand the perception, dont get me wrong. I understand the
perception, and I [UI].
JC: And, I see where youre coming from.
MK: [UI] legalities. But, understand that at the time, that was my mindset.
JC: Yea.
MK: Having looked at
JC: Possibility of criminal charges were not really real to you at that
time that it could potentially happen when you were involved in that.
MK: Um, it didnt become apparent to me until March 6th.
JC: Which
MK: When I read the complaint.
JC: On Sabu?
MK: On Sabu and others. Yea.
JC: And, thats why you sent me a little text. Were you unnerved by that?
MK: No, I sent you, uh, I sent you an email.
JC: Oh, it was an email, yea.
MK: Reuters wanted me to do a story on my involvement with, uh, my
observance

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 62 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

62 of 86

JC: Right.
MK: --with the InternetFeds because that was a story that really hadnt
come out. And, Adrian Chen and I had, had traded, um, the Gawker writer,
had traded emails, um, back and forth. I had given him access to some of
the screen grabs. Um, as I did with Parmy and, and a few others.
JC: Mmm hmm.
MK: Some of which I dont remember to be honest with you. Um, and, uh, in
reaching out to you it was for a story.
JC: Ok. I understand.
MK: It was because I was doing a story and as a journalist you have to
reach out to all of the resources you have available, and, um, I, dont get
me wrong, I understand why you werent able to respond. It doesnt surprise
me, frankly. Um, to answer your question about my, you know, going to the
chat rooms and being observant with Anonymous. January 2011 was, as far as
this is concerned, the last time that I went into any chat room or had
access to any chat room I was able to observe InternetFeds.
JC: Ok.
MK: When I was working at ABC, uh, we had Op BART happen in San Francisco.
JC: Ok, yea, yea.
MK: And, I went onto the chat room using a Disney computer and said is
there anybody that would like to talk us about this.
JC: Ok, but as a journalist?
MK: As a journalist. And, one person, and unfortunately, I, you know, I,
Ill be very honest with you, I dont know it was. If I, as far as screen
names or anything like that, you know, if you were to show it to me, I
wouldnt be able to say
JC: Yea.
MK: --you know, who it was. I wouldnt be able to confirm or deny one way
or another.
JC: Yea.
MK: But, to be completely honest with you, as it stands right now, I dont
remember the persons screen name. I dont remember the phone number that,

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 63 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

63 of 86

remember the persons screen name. I dont remember the phone number that,
you know, popped up on my caller ID when they called in. I, I genuinely
dont remember any of that.
JC: Ok.
MK: Um, that being said
JC: Alright.
MK: -- if you were to present me with like a chat log and said, What
happened?
JC: Well
MK: I wouldnt be able to confirm or deny one way or another.
JC: Would you be willing at a later time if we did, and you know, a better
venue, sit down and go over some of the chat logs? Uh, to, and explain who
was who that youre recollection and go over some of the names. And, um
MK: I can tell you when I found out who Sabu was it did not surprise me
because he had been very candid with me.
JC: Yea.
MK: In one of our conversations he said, you know, I live in New York. I am
a, he told he was a foster father of two boys, turns out that was
inaccurate.
JC: If it came to a trial or a hearing would you be willing to testify?
MK: On this? Or, on
JC: On anything. I mean
MK: Uh, can I say yes now?
JC: Yea, you can say whatever you want. I mean, its, uh, these are your
own words.
MK: I, I mean, I essentially I dont, I, I dont have full recollection of

JC: Yea.
MK: I can tell you that in terms of Op BART, you know, there was at least
one person that reached out and said

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 64 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

64 of 86

one person that reached out and said


JC: Ok.
MK: -- uh, I am willing to comment. We kept him anonymous as journalists
for various reasons. At the time, it seemed [UI].
JC: I understand. I guess, one other thing is that, you know, were, were
sitting here talking, um, at some point in time there is, you know, theres
a prosecutor back in Sacramento were going to have to share with him. And,
what we are going to share with him is, is how forthright you were, how
candid you were, how truthful you were, and that is going to be very
helpful.
MK: As far as what happened with Fox is concerned. I did it. My- There were
things that I did. I cant deny it. Im not going to now. I dont think I
ever really did with you. Um.
JC: I think whats interesting me to is, the, now that Im thinking, uh.
Well, let me just ask you this, would you be, uh, willing to put in
writing, uh, what you did for review that process specifically admitting to
the, um, taking the emails? Uh, and you can explain why, and then also
turning over the passwords.
MK: As far as the going, you know being publicly
JC: It wouldnt be, it wouldnt be a public record. This would be for the
prosecutor. And, including a statement of remorse.
MK: Yea, it, and, and this would be, you know, this would not be part of
any kind of court file, or
JC: Well, I cant promise anything. Well, I mean everything is
MK: By public, what I mean is, you know
JC: You want this to be a private and not be released to the public.
MK: I, I would ideally like this not to be released to the public and, but
I understand that, you know, the Freedom of Information Act and theres all
these different things that
JC: Well, there are other things to protect it as well. What we can say is,
uh, we wont release it, and, and there are provisions that a judge could
prevent its release. Uh, a judge can do whatever he wants, but we cant
make any promises.
MK: But, I also understand that in working, you know, in, in, what, what

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 65 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

65 of 86

MK: But, I also understand that in working, you know, in, in, what, what
you guys initially, I think, overall are looking for is information and
evidence.
JC: Thats pretty much it.
MK: Um, I dont think there is, as far as the hacking collective, I dont
think theres really, theres, youre not going to get much from me, you
know. And, its not because
JC: You know.
MK: I dont want to offer it. Its because I cant, you know. And, by I
cant, I mean I dont physically have the ability.
JC: The, the thing that you dont appreciate is you cant, uh, from where
were sitting, get the big picture, and how all of the pieces come
together.
MK: No. I completely understand that anything at this point helps.
JC: Yea.
MK: Believe me. I, Im not ignorant of the fact that any little piece of
the puzzle is going to help put together the bigger picture. And, again,
when you contacted me in April, when I was moving, my intention was not to
hide anything that had happened. I had gotten a new job.
JC: I understand.
MK: All of it. Things for me have been working fine, you know. Even given
this, things for me will still be fine. Um, at some point, you know, what
happened today is not, did not come as a surprise to me.
JC: I, Im sure.
MK: You know.
JC: Why, why dont we do this, why dont you start, uh
MK: But, what Im saying is [UI]. My concern is this eventually getting out
there under my name, um, and I know that there are ways that, you know,
like calling me a cooperating witness or, or something like that. Theres,
whatever in your ability to minimalize
JC: To the, and I, I
MK: [UI] the impact.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 66 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

66 of 86

MK: [UI] the impact.


JC: My problem is I, and Im, I can, I will minimalize the impact. I will
do everything in my power. My problem is that, uh, I cant, and Ill be
honest with you, I cant foresee any reason why it needs to go to the
public. Having said that, I dont control events in the court. So
MK: Well, part of the issue is that this offense was c-c-committed against
a news organization.
JC: Yea.
MK: And, theyre going to do
JC: I dont see why they would need to see it, and there are things that
can be done. I will, I will ask that it be redacted and not made available
to the victim. I cant promise it.
MK: Its ultimately up to the judge, I understand.
JC: Its ultimately up to the judge. In, in my, in my past experience, ok
MK: Mmm hmm.
JC: Things like this dont need to be seen. Unless, it actually goes to a
trial and theres some, you know, you know, this statement is used needed
to make, you know, and you decide Im, Im go to a trial and we have to do
something like that. Barring that, I dont see how it would come up in
public, or be made available to the public. It would be a part of the FBI
records. It would be shown to the prosecutor. Uh, it would be shown
obviously to you because you did it. But, beyond that, Im not aware of how
that would be released.
MK: Well, heres the thing
JC: Having said all of that, I dont want to make any promises.
MK: Like when you are, right now this is an accusation, you know. Um, I am
not being charged
JC: No charges have been filed.
MK: I have not been charged with anything.
JC: Have not been charged.
MK: Ive not been convicted of anything. Um.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 67 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

67 of 86

JC: And, it wouldnt be part of, if, if, if and when that you were charged,
it wouldnt be, uh, part of that. And, all of that is going to be done
MK: What do you mean it wouldnt be a part of that?
JC: Well, I mean, it, it wouldnt be incorporated like this as an
affidavit. It, it goes you, you know, you know, [UI].
MK: [UI]. In terms of the writing, Ill write whatever you want me to
write. [Laughter] Thats fine. I dont want to give you a blank check, you
know. So say, and, and make promises at least on my end that you know
JC: Im just giving you an opportunity to, to show remorse, to explain to
the prosecutor and show that Im fully cooperative.
MK: As far as this is concerned, whatever you need from me, you can have.
JC: Alright. Well, lets go ahead and, and
MK: If you want me to, you know. If youre able to get information that
leads you to an arrest of another individual. As a journalist, the
consequences that happened to the people that I write about, and as far as
Im concerned, this to me, is not just a life experience, but its now
become part of a story that
JC: Ok.
MK: Im involved in because I injected myself
JC: Yea.
MK: --into it as of March of last year. Um, my name is out there. People
know that I observed this room. There, there are parts of my observations
that have been published.
JC: Mmm hmm.
MK: Im sure youve read them.
JC: Mmm hmm.
MK: Um, there are parts of them that made it into the book, and youve read
it. [Laughter]. Or, youre getting through it. I have, actually, not read
the entire book myself. Um.
JC: Well, your concern is uh
MK: Two things. Two things. I would rather [UI].

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 68 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

68 of 86

MK: Two things. Two things. I would rather [UI].


JC: Ok.
MK: [UI] to be completely honest with you. Youre going to talk to whoever
you want to talk to thats involved in my life anyway. But, as, I can
honestly tell you that the person you want to talk with about this is me.
JC: And, its not our intent to go, for example, it sounds like your
concern is your career and Reuters and these types of things. Is, is that
what your concern is?
MK: Part of, part of it is my family.
JC: Ok.
MK: So.
JC: We dont need to talk to your family.
MK: I can tell you that
JC: We dont need to talk to Reuters.
MK: Ok.
JC: And, youve been totally candid with us, and youre cooperating. I
couldnt expect anything more from you, Matt.
MK: Ive always wanted to cooperate on this story.
JC: I understand.
MK: You know, to be completely honest, had somebody called me where I am
today, you would have no way of knowing this, but if somebody called me and
said, you know, were in New York or were in New Jersey, wed like to meet
and talk with, you know, with you about what happened, [UI], away from work
[Laughter]
JC: Yea.
MK: Meet at a Starbucks somewhere or, or
JC: Well, thats why were here today. I mean were not, were not at your
work.
MK: And, Id love to continue to keep in contact with you. If you have a
card, or, or

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 69 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

69 of 86

card, or, or
JC: And, we, we have a card. Were going to leave our cards. And, we will
certainly be in contact afterwards saying weve got to go back to, uh, you
know California, but uh, well be in touch with ya. And, you know, youll
be a dial a
MK: [UI] Jersey
JC: Yea, I could [UI] a nice place in Manhattan.
MK: I have to tell you, I love living here. I have
JC: Well, this is the center of the world.
MK: I have great roommates who will probably leave soon.
JC: Well, hopefully that doesnt, and you know, and, and in retrospect, uh,
and, um, Im going to leave you to write this thing here in a second
because I want to keep these guys out there and not mess up their lives too
much, but you know, theyre going to look at this as a bit of an adventure
as well.
MK: I can tell you I want to write whatever you want me to write in your
presence.
JC: Ok.
MK: Um. I dont know that right now Im in the state of mind where I can,
and its not because I dont want to, its because I want be cognizant of
any event.
JC: Ok.
MK: That you need me to recollect, and I just dont know that
JC: Alright.
MK: As of right now
JC: Youre going to have the presence in mind to remember all of the
details.
MK: I just, I just dont, and I, I
JC: Well
MK: [UI] I ultimately want to make sure that whatever I give you is going

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 70 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

70 of 86

MK: [UI] I ultimately want to make sure that whatever I give you is going
to be helpful.
JC: And, and I, I can appreciate that.
MK: And I dont, I dont want to leave any detail out.
JC: Well, let me, theres, theres
MK: I want to have a chance to look at this.
JC: Yea, I appreciate that.
MK: And, refresh my memory to these.
JC: Theres three issues that Id like to give to the prosecutor.
MK: Mmm hmm.
JC: Ok. First of all, uh, you know, Im fully cooperative.
MK: And, I understand that time is of the essence, too.
JC: Nah, kind of the essence. I mean, Id like to do it today. [Laughter]
But, uh
MK: We can do it today.
JC: But, uh
MK: Im just saying, in my pajamas, right now
JC: Yea.
MK: I dont know that I can.
JC: So, there-theres a couple issues Id like to get. One is, Im, Im
cooperative. Two is, yea, I worked at Fox News, and I took the emails.
Three is I gave the passwords to some guys on Anonymous. And, four is Im
sorry, and I regret my actions.
MK: I would like to give you whatever information is going to be helpful.
[UI]
JC: But, I dont want, yea, I dont want to put words in your mouth, or
MK: No, I understand.
JC: But, based on our conversation, I think thats pretty much what we

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 71 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

71 of 86

JC: But, based on our conversation, I think thats pretty much what we
talked about.
MK: Yea.
JC: And, it can be as simple as those four lines. But, I want it to be your
words. And, uh
MK: And, if thats what youre looking for, you know, we can put it on
paper now. But, if you want something more detailed.
JC: It doesnt have to be detailed. What Im looking for is
MK: And, the conversation that we had today, as long as it doesnt
interfere with, you know, my work, like I wouldnt be able to leave work at
2 p.m.
JC: Yea.
MK: to say
JC: Yea, what well
MK: Unless there was, in certain circumstances there was a subpoena that I
had to appear in court because, you know, youve caught a guy, and I might
know something about it, and you want to
JC: Were not going to call you at work Matt. What we gotta do is we got to
look at the computers.
MK: What, what Im trying [UI].
JC: [UI]
MK: There are certain, certain, you know, Im going to have to go work
today and say, Something happened. You know. I, I, this is, our
interaction is, its not going to be in a news story unless somebody leaks
it to like Gawker or Fox.
JC: Right.
MK: Or, anything like that. Um, I mean anything can happen like, like you
said. I, I to tell you where Im coming from Im going to have to go into
work today and tell my boss this happened.
JC: Mmm hmm.
MK: It doesnt have to be as detailed, and it wont be because I dont want

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 72 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

72 of 86

MK: It doesnt have to be as detailed, and it wont be because I dont want


to compromise anything that you guys are working on.
JC: Right.
MK: Im taking a step back as a journalist and saying this would, this
would be a story. Im giving you my word that as far as my abilities will
allow, I will do what I can to ensure that this isnt one.
JC: Ok. And, what we
MK: But, I do have to go to my boss.
JC: I understand. What you ask of us? What do you want us to do? How can we
help you?
MK: The first thing that I would like is a way to communicate with either
of you.
JC: Ok, alright, and were going to leave our cards and our email address.
MK: Or, anybody, that, you know, I can get in touch with.
JC: Ok. And, thats going to be us.
MK: I know how to get in touch with you, cause I have your email but I
dont know that I have your phone number. Um.
JC: Alright. Were going to give you our cards.
MK: And, I think I still have your voicemail, too.
JC: And, Ill answer my phone.
MK: Um. I dont send out my phone number when I felt kind of [UI].
JC: Ok.
MK: Um. I also dont answer my phone.
JC: Ok.
MK: Its not, I dont answer my phone to you. Its, I dont answer my
phone at all. Um, the easiest way to reach me is by email.
JC: Ok.
MK: [UI] e-mail leave records. Um, and I would prefer to communicate

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 73 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

73 of 86

MK: [UI] e-mail leave records. Um, and I would prefer to communicate
JC: Face-to-face like we are now.
MK: Or, by via phone or via Skype or by a [UI]. But, um
JC: I understand.
MK: Im not really concerned about that. As far as copping to what I did,
Im willing to do that.
JC: Ok.
MK: As far as writing something and saying, you know, youre looking for
four lines. I remember about two of those right now and you just said it
about five minutes ago.
JC: I know.
MK: Im willing to do that as well.
JC: Alright.
MK: Um, I would ask that as far as youre able to that this not become a
public issue. Um, I understand that, you know, as somebody that has access
to PACER and other, you know, ways, other, other databases that What I
would like to have happen, ideally, and whats going to happen are probably
two different things. Im very cognizant of that fact. Um, but I think in
speaking with you today, youre more, youre more than willing to advocate
for me.
JC: I am. I am. I understand, and I, I want to make sure I understand your
priorities. Youre, youre
MK: I, I also understand that as far as your abilities theres only so much
that you can do. That is not going to be, and I, I think is where youre
concern is. That is not going to be a deciding factor in how much or how
little Im willing to cooperate as far as how much Im willing to
cooperate.
JC: I understand. And, like I say, I think youve judged me right. I am
not, uh, here to make life difficult for you. I told you that at the
beginning. We, we want you to have a successful career and to be successful
in your endeavors, and we dont want that, um, to be derailed because of
anything. Having said that, [UI] issues resolved, and, and well see where
the chips fall. I mean, um, I cant predict what the future is going to be,
but were not going to go out of our way to hurt your career or your
professional life or anything.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 74 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

74 of 86

MK: You have a job to do, and I understand that. I, I do want


JC: Why, why dont we leave him with a piece of paper and a pencil. I want
to start on these computers because I got all of these guys out there, and
I dont want them, um, with the roommates and, if thats ok?
MK: Are they able to come in here?
JC: Yea, what they got to do, typically, what well do is they want to
photograph where, where it is in place. So
MK: Ive moved this since weve been in here.
JC: The, the laptop?
MK: Yea.
JC: Ok.
MK: Because I had to move
JC: Well make a note of that. Thats still, theyre still going to want to
make a note that it was on the bed.
MK: And, that youre more than willing
JC: And then
MK: And, youre more than welcome to open it. I will give them the
credentials to log into profiles.
JC: Ok.
MK: [UI] passwords.
JC: Oh, wonderful. Ok.
MK: Um, I would prefer not to tell you my password, but if you ask me for
it
JC: You know its, uh, we can get that easy. Its all, uh, its, we could
get that easy, I mean its hashed, the password is available.
MK: [UI] to a certain level. I understand that people can get those. Um,
yea, I mean [UI].
JC: You know, again, it goes, it, uh

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 75 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

75 of 86

MK: [UI].
JC: Let me go get them, and you can wait here. Why dont you start on that,
and essentially Ill give you, you can [UI]. One is cooperate.
MK: I will say though as far as [UI].
JC: Yea. Ok, Ill keep it on [UI]. Willing to cooperate, two is I did take
the emails, uh, from, uh
MK: Can I grab that paper from you because Id like to write these down as
youre saying them. Thank you.
GA: Yea, of course.
MK: And, Ill, Ill start a fresh piece [UI].
JC: But, I
the issues
Two is the
emails and

want it to be your own words, Matt. I mean, I these, these are


that I want to cover. One is that your willingness to cooperate.
emails and, and Fox News in Sacramento that you took those
that you were sending them under the, uh

MK: The third was the credentials, right?


JC: And, the third is that you gave the credentials to the CMS, uh, to the
guys on And the most important thing in my opinion
MK: [UI] dated?
JC: Yea, if it helps, yea. I mean, uh
MK: [UI]
GA: Yea.
JC: And, were going to give this to the prosecutor largely to explain the
key issues of cooperation and remorse which, uh, as you know are important
given where youre at.
MK: And, I would be more than happy to speak with him or her as well.
JC: And, there, there will come a time for that because theyre gonna wanna
kind of go over.
MK: What I dont know is possible, and Ill be completely honest with you
now, is I dont know that I could go to Sacramento to do it.
JC: We, uh, in terms of time? Or, in terms of money?

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 76 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

76 of 86

JC: We, uh, in terms of time? Or, in terms of money?


MK: In terms of both.
JC: Ok.
MK: Now, I understand
JC: But, well, we
MK: I understand you have resources to make that happen. Um
JC: Well
MK: Dont get me wrong, Ive, Ive covered enough of these.
JC: Yea.
MK: I, I understand how that happens. What Im saying is in terms of, its
really in terms of time and taking time off from work.
JC: Well, its, uh
MK: [UI]
JC: -- theres other things we can do there. The prosecutor, theres,
theres a situation called Rule 20, which all the legal stuff happens in
New York.
MK: Mmm hmm.
JC: So, it, it just depends on the prosecutor, really. Whether theyre
going to do what they call a Rule 20 which essentially moves venue. You
would waive venue, which is California.
MK: Which is what I think I did for Monsegur, right?
JC: Uh, [UI], I think they did. I think he waived venue. But, then, you
gotta get the, yea. He would waive venue, but then you gotta cause yea any
charging would have to be, done out here in New York. I, you know,
anything, I mean again, we dont control that, but there are mechanisms in
place to help you with your goals, and well make sure that gets
communicated and give you an opportunity to communicate with the
prosecutor.
MK: Sure. I would ideally like to communicate with the prosecutor before
that happens. In a perfect a world that would
JC: What well probably, uh, well probably have to figure out how to do

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 77 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

77 of 86

JC: What well probably, uh, well probably have to figure out how to do
the, the mechanism to do that.
MK: Let me tell you before you leave where, where everything is. Uh,
theres a computer there.
JC: Yup.
MK: Theres an iPad in there. Theres one right there. There should be two
hard drives in that, um, dresser. Uh, the TV has the ability to plug in the
USB drive. There may be one behind the TV. There is a USB drive floating
around here somewhere. Um
JC: Let, let me get the guys who are going to collect it with the camera
and everything
MK: And, Ill tell them [UI].
JC: And, you can tell them where everything is.
JC: Hey guys, sorry to bother you, he needs, uh, hes got a camera, hes
willing to show us where all the stuff is and what were going to take.
UM6: [UI] camera, and hes got the log, so.
JC: Well, lets go.
UM6: Alright.
JC: Sorry, Im sensitive to you sitting out here. [Laughter]
UMS: No, no, no. [UI]
JC: Yea, yea.
UM7: Alright, do we have a garbage bag?
UM8: Whats that? Ill bring one.
UM7: Yea, just put one in the [UI].
JC: Have the roommates taken off?
UM9: Yea, yea, I think they both [UI].
JC: Ok. Are they, uh, calm, or?

UM9: They were fine. I think one worked at Fox News.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 78 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

78 of 86

UM9: They were fine. I think one worked at Fox News.


JC: Oh, ok.
UM9: So [UI].
JC: Trying to make, write a story or something?
UM9: Yea, I dont know.
UM10: Are you, uh [UI]
JC: Yea. Huh?
UM10: [UI]
JC: Yes.
MK: [UI]. Im sorry, whats the time?
JC: Its 8 oclock.
GA: Yea.
MK: Its 8 oclock?
GA: Yea.
MK: Do you mind if you guys can come in. Do mind if I go over there and
turn the alarm off?
JC: Yea.
MK: Before it goes off.
JC: Yea.
MK: Ok. [UI]
JC: Alright, Matts going to show us where the stuff is, and then hes got,
hes going to write a little note there for us. And, your roommates are
gone, so.
MK: They probably went to work.
JC: Yea.
MK: Um, smart phone right there, ok.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 79 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

79 of 86

UM11: Do you want us to take overall photos first? Do you guys want to step
outside?
JC: Oh yea, well step back. What, typically what they do here, Matt, is
theyll take overall photos kind of show the layout of the room and
everything.
UM11: [UI]
MK: Uh, Ill get to this, yea, in a second, Ive, Ive gotta
JC; Well, just show them where everything is.
UM12: Yea, so smart phone is right over there.
MK: The smart phone is there.
UM12: Ok.
MK: Um, theres, uh, an Apple iPad in that bag.
UM12: Which bag? Are we talking about the smaller or the large one?
MK: The small one is mine. The large one is [UI].
UM12: Ok, alright. So theres an Apple iPad in there, ok.
MK: Um, there also maybe a USB thumb drive in there.
UM12: Ok.
MK: Um, theres also a Kindle.
UM12: Ok.
MK: I dont know if thats of any interest to you guys.
UM12: K.
MK: Apple i- uh, theres, uh, uh, an Apple iMac right there.
UM12: Mmm hmm.
MK: There are two hard drives in, I believe theyre in this drawer of the
dresser.
UM12: What about this one here? Is that in addition to?
MK: No, Im sorry, this is one of the two. Theres only two total. Theyre

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 80 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

80 of 86

MK: No, Im sorry, this is one of the two. Theres only two total. Theyre
both Toshiba.
UM12: Ok.
MK: Um, theres a black one. Theres also a gray one.
UM12: Is this the gray one right here?
MK: Oh, it is. So, theyre both on the dresser.
UM12: Ok.
MK: Um.
UM12: Any thumb drives or anything?
MK: No, but youre welcome to look.
JC: How about behind the TV?
UM12: How about the Western Digital box? Do you have anything stored on
there?
MK: So this is an Apple TV that
UM12: Oh it is? I, it looks like the Western Di
MK: To my knowledge theres nothing stored on it.
UM12: Ok.
MK: Youre welcome to take a look at it if you need to. Uh, if the thumb
drive is not in the I dont want to touch anything. If the thumb drive is
not in that bag, its behind the TV. Its plugged into the TV.
JC: And, wheres the data were looking for, Matt? Which device is it on?
Which, uh, hard drive?
MK: I dont remember which one its on, but its [UI].
JC: One of the hard drives, and is there, which laptop did you actually use
to communicate with, uhMK: For some of it, it is, um
JC: The one in there.
MK: The one in there.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 81 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

81 of 86

MK: The one in there.


JC: Ok.
MK: Mmm hmm. Sure. Theres a computer in there. Its on the top shelf of
the
UM12: Ok.
MK: Closet.
UM12: Mmm hmm.
MK: Theres a Roku Box somewhere around here, but it doesnt have anything
stored on it, and youre probably arent
JC: Dont need that.
GA: Clarifying question there for you, Matt. Um, I know you said that the
computer you used is in there, but have you transferred some those logs to
your, your Mac as well?
MK: No.
GA: So, the Mac has no records of, of this [UI].
MK: Ive plugged these hard drives into them, and I dont know to what
capacity these hard drives can move data over. I can tell you that I
havent deliberately moved any data or opened any, any files on this
computer pertaining to that. This computer is totally devoid of situations.
The computer that, that I think you guys are going to be more interested in
is that one in there.
GA: Just that there, and these two external hard drives.
MK: One of these has the files on it, and one of them doesnt. And, to be
honest with you, unless I plug it in, I wouldnt be able to tell which one
is and which one isnt.
GA: Ok.
MK: Um.
JC: Alright, what do you think here Gabe, do we want to, uh
MK: One more thing.
JC: Yea.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 82 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

82 of 86

JC: Yea.
MK: Theres a third computer. I no longer have access to it and that is the
computer that half of the communication took place on. Its since been
crashed because it just didnt work.
JC: Where is that?
MK: Im sorry?
JC: Where is that computer?
MK: Its, its gone. I, I
JC: Oh, you threw it away.
MK: I, I no longer have access to it.
JC: Ok.
MK: Its just gone.
JC: Ok.
MK: Um, that having
JC: Did you sell it? Did throw it away?
MK: That having been said its since been disposed of. That having been
said anything that was on that computer
JC: Is on the hard drive?
MK: Is somewhere on there. So, its in that zip drive that I told you
about.
JC: Alright.
MK: So, I would love to be able to offer that up to you. I just dont have
[UI].
JC: How did you dispose of it?
MK: So, I left it at my grandmothers house.
JC: Ok.
MK: And, she got rid of it.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 83 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

83 of 86

JC: Ok.
MK: Um, and I will call her and ask her.
JC: Alright. Uh.
MK: It may actually, we may actually been able, be able to I dont know
how she got rid of it.
JC: Alright.
MK: Ill ask her, and if its something that I can reasonably get access
to.
JC: Well, we wont reach out to her. I mean, uh, youve asked us not to
contact your family so, uh.
MK: I, I will reach out to her, and if she can give me, if she
JC: Knows where it is.
MK: If she gave it to a relative or knows where it is or, or disposed of
it, I can at least figure out what she did with it. If she threw it in the
trash or [UI].
JC: Alright. So, these we definitely need to take with us.
MK: This one.
JC: What else do we need take?
GA: The laptop out there. I dont think that we need to take this one. Hes
being forthcoming with
MK: Would you like to look at it?
UM13: Um.
JC: Ill, I
GA: I guess I could take a quick look through it while you make your, your
statement.
MK: Sure, thats fine.
JC: And, uh, how about on the thumb drive? Whats on the thumb drive?
MK: Thumb drive is exclusively used for work.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 84 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

84 of 86

MK: Thumb drive is exclusively used for work.


JC: Ok.
MK: So, that has, uh, passwords to our social media profiles. We were
hacked into not too long ago, um, or phished. I think we were phished. Uh,
and so the only thing on that, uh, thumb drive are Reuters passwords and
movies because I play them on my TV [UI].
JC: Ok. So we dont need that. And, um, cell phones?
MK: And, again, youre welcome to look at that if youd like. Cell phones.
Didnt use that at all for theJC: Ok.
MK: The Anonymous thing. There is a text message that I sent to somebody
that I think is Jack Davies. Youre welcome to look at that. Um, but there
was no response on his end.
JC: Ok.
MK: And, I dont even know that I was given correct information.
JC: So this, this, and the closet is what we care about.
MK: And, youre welcome to have those.
JC: Alright. Why dont you work on that for me, uh, your notes.
MK: Now, I know you guys can do forensics things.
JC: Yea.
MK: One other thing that I want to mention. These have never been erased.
They are from, you know, from the day I bought them theyve had information
stored on them and taken off them. Theyve never been formatted. That
computer has been.
JC: Ok.
MK: And, it has, and its not because it was formatted due to anything
involving this. Its because it got slow, and I just took everything off it
[UI].
JC: Ok.
UMS: Was it formatted or was it wiped like zeroes and ones? I mean, was it,

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 85 of 86


288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

85 of 86

UMS: Was it formatted or was it wiped like zeroes and ones? I mean, was it,
was it wiped?
MK: I did, um, so theres an option on the Mac, uh, where you can do like a
secure, where it just rewrites the data a bunch of times.
GA: Ok.
MK: I chose that option. I think I got frustrated with how long it took
because that computer is slow, and I canceled out of it and just did a
fresh install.
JC: Alright. Well, well see what, uh, comes up on that.
MK: Yea, youre welcome to take them.
JC: So, its a, uh. Id do the forensics in Sacramento so Im familiar
with, uh, Linux or the HFS. Alright, well, uh, you guys are ready?
UMS: Were ready, yea.
JC: Uh, you, you want to do it out here? Or you wanna
MK: Yea. Can I grab that [UI].
JC: Yea, you can take your affidavit there, search warrant and.
MK: Alright.
JC: [UI]. And, Ill, uh, step out here with you.
MK: Im going [UI] if thats ok?
JC: Thats fine.
MK: [UI]
JC: Yea, why dont you, uh, just pick a chair. Im going to pull this
around for you here on that side so you can sit and take notes.
MK: [UI]
JC: Thats our stuff.
MK: Ok.
JC: Yea, theyre getting ready, were getting ready to, uh Oops, Im
sorry. Im so sorry.

FD-302a (Rev. 05-08-10)

Case 2:13-cr-00082-KJM Document 72-1 Filed 09/09/15 Page 86 of 86

288A-SC-45485
Continuation of FD-302 of

Transcipt 1D1 & 1D2

, On

10/04/2012

, Page

86 of 86

sorry. Im so sorry.
UMS: [UI]
JC: Have a seat right there, Matt.
UM14: [UI]
JC: No, I dont think we need that. Thats alright.
GA: Just trying to avoid.
JC: Im going to step out for a second here. [UI] Alright So the time is
8:05 [FBI Note: 1D2 Ends] We started at a roughly a little after 6
am.[FBI Note: 1D1 Ends]

Case 2:13-cr-00082-KJM Document 68-1 Filed 09/09/15 Page 1 of 2

Exhibit A

Case 2:13-cr-00082-KJM Document 68-1 Filed 09/09/15 Page 2 of 2


U.S. Department of Justice
Criminal Division

Computer Crime and Intellectual Property Section

Washington, D.C. 20530

March 26, 2015


Via Electronic Mail
Tor Ekeland, Esq.
Tor Ekeland, P.C.
Attorneys at Law
195 Plymouth Street, Fifth Floor
Brooklyn, NY 11201-1044
Re:

Jay
Esq.
Jay Leiderman Law
5740 Ralston Street, Suite 300
Ventura, CA 93003

United States v. Matthew Keys

Dear Tor and Jay:


Pursuant to Federal Rule of Criminal Procedure 12.1 ("Notice of an Alibi Defense"), we request
that you notify the government of any intended alibi defense for the times, dates, and place of
certain acts undertaken in connection with the alleged offenses contained in the table below. The
times and dates listed in the table do not represent the entire time period of the alleged offenses.
Sacramento
Local Time
20:45; 23:06
2:39
13:27
14:31
12:09
10:21

Date
November 2, 2010
November 2010
November 29, 2010
December 12, 2010
December 13,2010
December 15, 2010

Place
Shadow Tree Drive, Apt. 327, Sacramento,
Shadow Tree Drive, Apt. 327, Sacramento,
Shadow Tree Drive, Apt. 327, Sacramento,
Shadow Tree Drive, Apt. 327, Sacramento,
3381 Shadow Tree Drive, Apt. 327, Sacramento,
Shadow Tree Drive, Apt. 327, Sacramento,

California
California
California
California
California
California

Rule
requires your response within
days of the government's request, or at some
other time as the Court sets; please notify us i f you seek additional time to respond.

James Silver
Deputy Chief for Litigation
Cc:

AUSA Matthew Segal; AUSA Paul

Você também pode gostar